Remove sourcemap link from boot script

The previous regex would have matched any line that happened to contain
the text 'sourceMappingURL'.

Add docs for on login

"Keys" here is programmer jargon, and hopefully the client configuration
documented on this page should be usable by people who aren't
programmers.

config.md was interchangeably using "sidebar" and "client" to refer to
the client. Fix it to always use "client" because it's more consistent.
I chose client instead of sidebar because (both technically speaking and
in terms of the UI) not all of these settings actually refer to the
sidebar, e.g. showHighlights and assetRoot. Also client is the word used
by the git repo name and in the README file.

For example "Client behavior" was a sibling heading of "Config keys",
not a sub heading as intended. Fix all the heading levels so that
headings are nested as they were intended to be.

Add overview of client security considerations

Add a preliminary overview of client security considerations and
implementation decisions.

Developing docs tweaks

The replacement of var placeholders with values invalidates the
sourcemap locations and the sourcemap URL is invalid after the file is
copied from build/scripts/ to build/. Since the script is tiny the debug
info is not that valuable so this commit just removes the sourcemap URL
to avoid browsers complaining that they cannot retrieve it.

sudo isn't required on all systems (e.g. macos)

For example Node is a prerequisite because we just tell you that you're
going to need it before you can follow these instructions. Gulp is not a
prerequisite, it's a dependency, because the instructions tell you how
to install it.

This OS-specific dependency was inadvertently added to the shrinkwrap in
ed4afca0

Add eslint rule to raise a warning if any of the tests are using the …

Add a guide to developing the Hypothesis client

Add an initial guide to developing the Hypothesis client, covering:

 - Installation
 - Getting a local build of the client working with the browser
   extension or a local Hypothesis service
 - Running tests
 - Some basic pointers on code style and where to find guidance for
   creating pull requests

This guide assumes that the service is configured to use the client's
new boot script.

Add tests for login control.

Add CORS headers to assets served by the client's dev server, otherwise
the client's icon font will fail to load in many browsers.

Due to a problem where an earlier version of 1.0.0 and 1.1.0 were
published to npm and then unpublished, thereby preventing re-use of
these versions, we're going to skip straight to 1.2.0.

Call partner provided login callback