Bump mocha from 7.1.2 to 7.2.0

Bump karma from 5.0.8 to 5.0.9

Bump terser from 4.6.13 to 4.7.0

Bump fetch-mock from 9.9.0 to 9.10.1

Bump preact from 10.4.1 to 10.4.4

Fix installing tox

Update 3 config keys

- `allowLeavingGroups`
- `groups` when used with “$rpc:requestGroups” value
- `requestConfigFromFrame`

Our scripting automatically installs tox in pyenv so you don't have to
install tox manually or system-wide. Unfortunately it wasn't working:
the installed tox doesn't appear on your PATH until you run a
`pyenv rehash`

Bump chance from 1.1.5 to 1.1.6

Remove `OAUTH_TOKENS_CHANGED` event

Remove unused diff-match-patch dependency

We don't use this package directly any more, although there is still a
transitive dependency on it via dom-anchor-text-quote.

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.679.0 to 2.683.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.679.0...v2.683.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [@octokit/rest](https://github.com/octokit/rest.js) from 17.9.1 to 17.9.2.
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](https://github.com/octokit/rest.js/compare/v17.9.1...v17.9.2)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [preact](https://github.com/preactjs/preact) from 10.4.1 to 10.4.4.
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](https://github.com/preactjs/preact/compare/10.4.1...10.4.4)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [terser](https://github.com/terser/terser) from 4.6.13 to 4.7.0.
- [Release notes](https://github.com/terser/terser/releases)
- [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/terser/terser/compare/v4.6.13...v4.7.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [chance](https://github.com/chancejs/chancejs) from 1.1.5 to 1.1.6.
- [Release notes](https://github.com/chancejs/chancejs/releases)
- [Commits](https://github.com/chancejs/chancejs/compare/1.1.5...1.1.6)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [mocha](https://github.com/mochajs/mocha) from 7.1.2 to 7.2.0.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mochajs/mocha/compare/v7.1.2...v7.2.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [karma](https://github.com/karma-runner/karma) from 5.0.8 to 5.0.9.
- [Release notes](https://github.com/karma-runner/karma/releases)
- [Changelog](https://github.com/karma-runner/karma/blob/master/CHANGELOG.md)
- [Commits](https://github.com/karma-runner/karma/compare/v5.0.8...v5.0.9)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [fetch-mock](https://github.com/wheresrhys/fetch-mock) from 9.9.0 to 9.10.1.
- [Release notes](https://github.com/wheresrhys/fetch-mock/releases)
- [Commits](https://github.com/wheresrhys/fetch-mock/compare/v9.9.0...v9.10.1)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: Kyle Keating <kkeating@hypothes.is>

Co-authored-by: Kyle Keating <kkeating@hypothes.is>

* Add `aria-expanded` to sidebar show/hide button

* Add axe test to annotator toolbar component
Co-authored-by: Kyle Keating <kkeating@hypothes.is>

Use `aria-expanded` instead of `aria-pressed` per a11y audit

Remove the last remaining use of the `$rootScope` service to broadcast /
subscribe to the `OAUTH_TOKENS_CHANGED` event.

Instead the `auth` service is now an `EventEmitter` and the `session`
service subscribes directly to `oauthTokensChanged` events from it.
Whereas we replaced most other events with observers which react to data
changing in the store, this particular use case doesn't lend itself to
that and it makes more sense for the `auth` service to emit events to
notify interested consumers.

Replace the `BEFORE_ANNOTATION_CREATED` event

 - Move a comment down to the `useEffect` call it referred to
 - Reword the note about what happens when there are multiple unsaved
   annotations and the newest one is removed or saved

Remove redundant “Select” and “tabs” verbiage

It is possible for multiple unsaved annotations to exist if a user
creates a new annotation, enters some text but does not save, and then
creates another new annotation. In this case, make the thread list
always scroll to the newest. A side effect of the implementation is that
if this second annotation is then deleted or saved, the thread list will
scroll back to the previous unsaved annotation. This behavior seems
useful, so I've kept it.

The `BEFORE_ANNOTATION_CREATED` event was used for two purposes:

 1. Invoke `annotationsService.create(...)` to create the annotation in
    the sidebar.
 2. Scroll the newly created annotation into view

Resolve (1) by calling `annotationsService.create` directly from the
`frameSync` service and resolve (2) by watching for changes to
`unsavedAnnotations()` in the store and scrolling to the new annotation
when it appears.

There is one functional change which is that replies will be scrolled
into view, as this seems like a useful behavior if the user clicks the
"Reply" button for a thread and the input field appears below the bottom
of the screen.

Improve loading state for LMS, all users

Make fetch exceptions consistent and filter them from Sentry

Improve handling of annotation fetch error in single annotation view

Previously if the user visited a `/a/<ID>` URL and the request to fetch
the annotation failed with a 404 then the user would see a blank page.
If the fetch failed because the annotation was private, logging in did
not cause the annotation to be fetched.

This commit resolves the two issues:

 - When the logged-in user changes, re-fetch the annotation
 - If the annotation fetch fails, an "Annotation unavailable" message is
   shown. This currently repurposes the error that is shown when a
   direct-linked annotation fetch fails, but without the "Clear
   selection" button.

This commit also fixes an issue where a direct link to a group that
could not be fetched would show a "Clear selection" button even though
there was no active selection to clear. That button is only needed when
following a direct link to an annotation.

For the places in the application that we care about whether “things are
currently loading”, whether annotations have ever been fetched is relevant.
Consider the application to be loading if there are any in-flight API
requests OR annotations have never been successfully loaded.