Add client for making JSON-RPC calls over postMessage

Add "requestConfigFromFrame" string setting

Without this field all the test cases still pass, but for the wrong
reason, since the origin field is checked before other event properties.

Replace "var" with "const" or "let" everywhere

This setting will cause the sidebar app to fetch its configuration via
a postMessage request to frames with the given origin on startup.

The setting is not actually used yet. This is coming in future commits.

We need a way for the client to request configuration from an embedding
frame over `postMessage`.

JSON-RPC is a well-known, simple and convenient format for RPC messages.

There are several npm packages which claim to offer this functionality
but at the time of writing, none appeared to be sufficiently well
tested/supported/documented.

There is an existing partial postMessage JSON-RPC server implementation in
src/sidebar/cross-origin-rpc.js. The non-app specific parts of that will
be moved into this module in future.

To ensure consistency going forwards, enforce usage of const/let

Fix the uses which js-codemod's "no vars" transform was unable to change
automatically.

This is the result of using jscodeshift [1] to apply the "no-vars"
transform from js-codemod [2] on all code in scripts/ and to gulpfile.js

[1] https://github.com/facebook/jscodeshift
[2] https://github.com/cpojer/js-codemod

This is the result of using jscodeshift [1] to apply the "no-vars"
transform from js-codemod [2] on all code in src/ except for
src/{annotator, sidebar}/vendor.

[1] https://github.com/facebook/jscodeshift
[2] https://github.com/cpojer/js-codemod

Add documentation for externalContainerSelector

Update to Node 10 for Jenkins and Travis builds

The official Docker node builds now have Yarn preinstalled, so use that
instead of a community-provided image.

Use `yarn version --minor` to bump the package version.

This requires Yarn >= v1.7.0.

Inject a default organization into groups objects without organizations

Create annotation when clicking "Annotate" button label

Hide "Public" group for unauthenticated users (alternate implementation)

Implement a business requirement that the "Public" group should be
hidden from the groups list if all these conditions are met:

 - The user is logged-out
 - The current document has groups associated with it
 - The user has not visited a direct-link to an annotation in "Public"

---

This requirement introduces a complexity in that deciding which group to
focus and fetch annotations for after initially fetching groups now
depends on the current profile. However the profile and groups are
fetched concurrently to reduce the number of API round-trips before we
can show annotations in the client.

Fortunately we don't need to know the exact userid to know which group
to focus, only whether the list of groups was fetched as a logged-in
user or not. This can be determined from the access token that was sent
with the `/api/groups` request.

Remove obsolete JSDoc comments

Add an option to return metadata in the response as well as just the
JSON response from the server. This will initially be used to determine
the access token that was used to make the request and therefore whether
it was authenticated or not. In future it could also return information
from HTTP headers or the status code if useful.

Remove unnecessary extra `/api/groups` call on startup

Respond to PR feedback.

This event is never broadcast anywhere. A comment referenced this being
called when a user leaves a group, but this is handled in the `streamer`
service by calling `groups.load()` directly.

On startup an initial `FRAME_CONNECTED` event is fired when the main
frame connects to the sidebar. This triggered an extra `/api/groups`
fetch. Avoid this by recording the main frame URI used in the last
groups fetch in  `load()`. The existing test in the `FRAME_CONNECTED`
handler then skips the `load()` call if this URI has not changed.

The group service does not have `add` or `remove` methods any more.

Fix `groups.focused()` error if localStorage is empty when client loads