Replace "firstRun" config option with "openSidebar" and "openLoginForm"

Update npm-shrinkwrap.json

Embed release version in built package

Fix incorrect usages of the $rootScope

I'm not really sure I understand the mechanism by which this is out of
date or even what the changes here imply, but this is the result of
running

    npm shrinkwrap --dev

with latest npm (3.10.5), and the output appears to be stable --
multiple runs do not change it further.

In addition, installing new packages and rerunning `npm shrinkwrap
--dev` appears to generate a minimal diff after this one-off update.

Rather than relying on the release version being passed in as config,
build the current release version (as read from `package.json`) into the
bundle.

We use browserify-versionify for this, rather than simply requiring
`package.json`, as our current build toolchain does not support any kind
of tree-shaking, so `require('package.json')` would pull the whole of
the `package.json` file into the bundle.

This commit deprecates the confusingly-named "firstRun" embed script
option with two which actually describe the relevant actions triggered.

Unfortunately, at the moment this requires a fairly horrific check that
the string value of a config option is not the literal 'false', due to
the way that the Host code passes configuration from the page frame to
the sidebar frame (using URL query string parameters).

Use shared ESLint config

As described on the trello card:

https://trello.com/c/2NHJkRLa/407-audit-client-for-incorrect-rootscope-usage

there are components or controllers subscribing to events directly on
the root scope via `$rootScope.$on()`. This patch moves those hooks to
the correct `$scope` and causes those events to be `$broadcast` instead
of `$emit` to the root scope.

Fix up indentation using `eslint . --fix`

Use the shared `hypothesis` ESLint config for consistency with our other
projects

* Make the adder a self-contained component

Move adder event handling and UI creation to Adder component, so that
Guest does not need to know about its internal structure or handle
events for it. Instead it just supplies callbacks to invoke when the
Annotate and Highlight buttons are clicked.

This makes it easier to test event handling for the adder and to make
future changes to the UI of the Adder.

This commit removes a piece of logic that stopped propagation of
'mouseup' events from the adder because I couldn't find a clear
explanation in the code or commit history of why that was done.

* Remove a couple of misplaced assertions from tests

Remove assertions checking the horizontal position of the adder in tests
which are only concerned with the vertical position of the adder
relative to the selection.

Fix the "create a free account" link on the sidebar CTA

Avoid double highlighting

When the client is destroyed, it's important that we correctly tear down
the frame-rpc event listeners (bound to the document's `onmessage`
event).

These event listeners are responsible for relaying messages from the
frame-rpc mechanism to various parts of the code on either side of the
frame boundary, including the `AnnotationSync` component. If the
frame-rpc channels aren't correctly torn down, they will hold a
reference to the `Bridge` object, which in turn holds a reference to the
`AnnotationSync` object, and thus old copies of `AnnotationSync` which
should have been garbage-collected will continue to receive events from
the brand new Hypothesis client.

The most visible result of this problem was that repeated activation and
deactivation of the client would result in increasing numbers of
highlights being drawn on annotated text, as reported in
hypothesis/h#3096.

Fixes hypothesis/h#3096.

PhantomJS supports ES5 fully and does not require specific polyfills for
it. This means that we can use exactly the same polyfill script in both
our unit tests and the actual app, which reduces the chances of breakage
due to mismatches.

Additionally, the broken URL constructor could potentially affect other
browsers, so it makes sense to include it in the main polyfill script.

Defer initialization of websocket client until sidebar is interacted with for logged-out users

Using `$rootScope.$on` to bind event handlers in a controller is usually
going to result in bugs, because:

- The lifecycle of `$rootScope` is that of the entire application --
  that is, it never gets torn down.
- The lifecycle of the controller depends on when and where that
  controller is instantiated. In our case, logging in and logging out of
  the application triggers a route reload[1], which tears down the
  WidgetController.
- WidgetController has no ability to unbind event handlers when it is
  torn down.

Luckily the fix is relatively straightforward. Because this event is
`$broadcast` on the root scope, it propagates to all child scopes. Thus,
we can listen to the event on the controller's local `$scope` and ensure
that the handlers are garbage collected along with the scope when the
controller is torn down.

[1]: https://github.com/hypothesis/client/blob/d6a1392/h/static/scripts/app-controller.js#L71

until sidebar is interacted with for logged-out users

https://trello.com/c/53uY3Xit/386-defer-initialization-of-websocket-client-until-sidebar-is-interacted-with-for-logged-out-users#

Move root UI structure into an "app" component

Set the `ng-csp` attribute on the document body on app startup before
Angular is loaded to avoid triggering warnings when app.html is served
with Content Security Policy headers.

This used to be done via an `ng-csp` attribute on the <body> tag in the
app.html file served by the `h` service but this moves it to client code
to avoid the service needing to know this implementation detail of the
client app.

This was needed when this part of the app template lived in the `h`
repository. It is not needed any more.

Move the template which defines the structure of the top-level of the UI
from `app.html.jinja2` in the hypothesis/h repo into the client.

This means that the H service only needs to serve an app.html page
containing a `<hypothesis-app></hypothesis-app>` placeholder in the body
which the app will then load into.

Remove SASS variables and mixins which are not used by the client

ESLint - Enforce indentation, quote style and `this` style consistency

Since this module was imported with minor changes from
substack/frame-rpc, disable ESLint to avoid adding noise to the Git
history for this file.

See https://github.com/hypothesis/client/pull/32#discussion_r70957311