Adding support for onLayoutChange notifier configuration

- Add a doc comment to the _notifyOfLayoutChange function to clarify the
  purpose of the optional param.
- Add a comment inside the function to describe the high-level structure of the
  sidebar and how expanding/collapsing it is achieved.
- Correct a typo with "frameVisbileWidth"

Capture the client url to be used in subframes

When the client served by the browser extension injects itself into
child iframes on the current page, it needs to include the "assetRoot"
config setting in order for the client in the iframes to be loaded from
the extension rather than the default CDN URL.

Persist access and refresh tokens to localStorage.

Frame validity checks

As noted in PR feedback, the OAuth token key should be based on the
annotation service rather than just authority. The annotation service is
currently identified by (API domain, authority) but in future we'll
likely integrate the authority into the API URL for 3rd-party accounts
(eg.  "https://publisher.hypothes.is/api").

Rename for consistency with `saveToken`.

Convert search query parser to JS and add tests

Removing flags for multiple iframe support

For code in newly created JS files, arrow functions should be favored.

In the process fix an inconsistency where the "since" term was returned
as a number for hours, days, weeks, months and years but as a string for
seconds.

Convert the SearchFilter class to JS using decaffeinate and convert
methods which do not depend on any external state, which is all of them,
into plain functions.

Persist access and refresh tokens to localStorage, under the key:

  hypothesis.oauth.<authority>.token

Where `<authority>` is the domain of the annotation service and the
structure is the JSON-encoded object:

  {
    accessToken: <token>,
    refreshToken: <token>,
    expiresAt: <UNIX timestamp in ms>
  }

When an API token is requested for the first time during startup, the
existing token for the current authority is loaded from storage,
validated locally and then used if possible.

We should review whether or not to include this file in the source tree,
given that we use Yarn primarily for package management, but since it is
here, keep it up to date.

Fix adder position when document or body position is offset.

Use OAuth for first party login if enabled.

Respond to CR feedback in
https://github.com/hypothesis/client/pull/476#discussion_r126539329

Avoid mutating frames array in DESTROY_FRAME action.

Fix positioning of the adder when the document or body elements are
positioned and offset relative to their default position.

There were two problems:

 1. When converting from viewport to "document" coordinates, code in
    `adder.js` and `range-util.js` failed to account for the document
    element's position being offset from the default (0, 0) location.
 2. When setting the adder's top/left coords, `Adder#showAt`
    did not take into account the offset of the body element from the
    document.

This commit fixes the issue by:

 1. Using viewport coordinates as far as possible in the range-util and
    Adder functions to reduce the need for converting coordinates.

 2. Calculating the position of the adder by comparing the target
    viewport coordinates for the adder and the viewport coordinates of
    the adder's nearest positioned ancestor.

Fixes #487

The state is supposed to be immutable. `Array#splice` modifies its
argument. Use `Array#filter` instead which returns a new array.

Emit an event on the Guest element, ‘scrollToRange’

Follows DOM event name conventions.

If the service provides an OAuth client ID and sets the "oauthEnabled"
flag in the app configuration, use OAuth for first party login.

This initial implementation does not persist the token for future use,
so the user has to login every time they use the app.