Pass "authority" query param when fetching groups list

Without this argument, the "h" service does not know which authority's
groups should be returned if the user is not logged in.

Show a list of groups for logged out users.

At the moment we only show one group i.e Public for logged out users.
we should also show those groups to logged out users.
See https://github.com/hypothesis/product-backlog/issues/417

Only wait for document URI before fetching groups in sidebar

Fixes a regression after 36c46608 where the stream and single
annotation page views failed to load.

36c46608 made the groups service wait for the host page's document URI
to be determined before making a call to the `/api/groups` endpoint
passing that URI as a parameter. In the stream (`/stream`) and single
annotation page routes, there is no host page and so
the promise returned by `getDocumentUriForGroupSearch` never resolved.
Avoid waiting for this URI in that case and avoid passing the
`document_uri` parameter to the `/api/groups` endpoint.

This commit introduces a new `isSidebar` test rather than using
`annotationUI.isSidebar` because that piece of app state is not yet
initialized at the point when `groups.load()` is called in the route's
`resolve` function in src/sidebar/index.js.

Get the list of groups from the new endpoint and update it where applicable

Fetch the list of groups from the new `/api/groups` endpoint instead of
using the groups list returned in the `/api/profile` result. This
supports providing the current document URI as a parameter, which
enables the server to change the list of open groups returned depending
on the current URL.

In order to update the groups list correctly, taking into account the
current document URI, when the user joins or leaves a group, the
`streamer` service now handles "session change" notifications by
triggering a re-fetch of groups from the `/api/groups` endpoint instead
of updating the groups directly from the payload of the WebSocket
message.
Co-authored-by: Robert Knight <robertknight@gmail.com>

Update to Angular 1.6.9

Fix spinner animation

Fix a test failure due to a subtle issue with the interaction between
the `$q` service, `AnnotationController#delete` and `$timeout.flush` in
tests.

Instantiating the rejected promise _before_ calling `$timeout.flush`
resulted in Angular's unhandled promise checking code being triggered
in the test.

Fix occurrences of a "multilink" [1] error during test for the
annotation save button.

Replace calls to the link function with direct assignments to controller
properties.

[1] https://code.angularjs.org/1.6.9/docs/error/$compile/multilink

The main change that affects us is that component inputs/bindings are no
longer available as controller properties in the constructor by default.
Instead this logic should go in a controller's `$onInit` method.

In this commit use the `$compileProvider.preAssignBindingsEnabled`
compatibility helper which preserves the Angular <= 1.5 behavior. This
is being removed in Angular 1.7.

`@keyframes($name)` is not legal syntax. I'm unsure if this ever worked
in the past in older browsers or if it was previously converted by a
post-processor to valid syntax.

Refactor export of bound selectors from Redux store

Group the selectors in each Redux module together in a `selectors`
object so they can be re-exported as methods on the Redux store without
having to list each of them manually.

This also just makes it easier to visually see which exported functions
from a Redux module are selectors.

Hide the direct-link CTA for third party accounts

The CTA message shown when an anonymous user visits a direct link
contains links to the Hypothesis site and makes other assumptions, such
as the user being able to create accounts and those accounts being free,
which may not be applicable on sites that use third party accounts.

For now, just hide this CTA if the page uses third party accounts.

Fixes #656
Fixes #657

Add script to initiate a client release

Add a script to handle creating a new client release using yarn,
ensuring that the Git tag is signed. Unfortunately yarn's default is for
this setting to be turned off. Also unlike `npm version`, `yarn version`
does not support automatically incrementing the package version.

Fix login flow triggering popup blocker in Firefox and IE

Use the verb form for correctness in context and consistency with text
on the h web pages.

 - Use the term "auth" for consistency with the `authorize` method and use
   the verb "open" to clarify that the popup window is being both created
   and shown.

 - Clarify the relation of the `$window` parameter to the returned
   window.

hypothesis/client#603 broke the login popup window in Firefox and IE
because the call to `window.open` no longer happens in the same turn of
the event loop as the user's click on the "Login" link. It is therefore
no longer considered in FF to have happened "in response to a user
gesture".

This PR fixes the issue by separating creation and use of the popup
window into separate functions and moving creation to happen earlier, in
the same event loop turn as the "Login" button click.

Fixes #534

Now there are two separate links for requesting an invite to our public Slack workspace (slack.hypothes.is) and accessing the workspace once you already have an account (hypothesis-open.slack.com)