Bumps [@babel/core](https://github.com/babel/babel) from 7.6.2 to 7.6.3.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/master/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/compare/v7.6.2...v7.6.3)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Enable Chrome tracing during startup

This enables very detailed logging of network activity, page execution
and script execution for 7 seconds after startup.

This is part of debugging frequent CI build failures in the client repo
on Jenkins. From the Karma logs I can see that all of the test files are
requested from the Karma server, but none of the log messages associated
with test execution are seen. This tracing should make it possible to
find out which JS scripts even execute.

Share Annotations Panel 1 of 4: Update icons; allow inline icons

Change SASS processing pipeline to match h, lms projects

Don't built the client a second time when running "npm publish"

Bump gulp-changed from 4.0.1 to 4.0.2

Bump autoprefixer from 9.6.1 to 9.6.4

Bump aws-sdk from 2.538.0 to 2.543.0

Bump cross-env from 6.0.0 to 6.0.3

Bump preact from 10.0.0-rc.3 to 10.0.0

Bumps [@octokit/rest](https://github.com/octokit/rest.js) from 16.30.1 to 16.32.0.
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](https://github.com/octokit/rest.js/compare/v16.30.1...v16.32.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [cross-env](https://github.com/kentcdodds/cross-env) from 6.0.0 to 6.0.3.
- [Release notes](https://github.com/kentcdodds/cross-env/releases)
- [Changelog](https://github.com/kentcdodds/cross-env/blob/master/CHANGELOG.md)
- [Commits](https://github.com/kentcdodds/cross-env/compare/v6.0.0...v6.0.3)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [eslint](https://github.com/eslint/eslint) from 6.5.0 to 6.5.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v6.5.0...v6.5.1)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [preact](https://github.com/preactjs/preact) from 10.0.0-rc.3 to 10.0.0.
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](https://github.com/preactjs/preact/compare/10.0.0-rc.3...10.0.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [gulp-changed](https://github.com/sindresorhus/gulp-changed) from 4.0.1 to 4.0.2.
- [Release notes](https://github.com/sindresorhus/gulp-changed/releases)
- [Commits](https://github.com/sindresorhus/gulp-changed/compare/v4.0.1...v4.0.2)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.538.0 to 2.543.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.538.0...v2.543.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [autoprefixer](https://github.com/postcss/autoprefixer) from 9.6.1 to 9.6.4.
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/master/CHANGELOG.md)
- [Commits](https://github.com/postcss/autoprefixer/compare/9.6.1...9.6.4)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [dompurify](https://github.com/cure53/DOMPurify) from 2.0.3 to 2.0.4.
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](https://github.com/cure53/DOMPurify/compare/2.0.3...2.0.4)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Fix an issue with the CI build where both the `yarn version` and
`npm publish` commands would both build the client's assets.

Since the output of the build process can be affected by environment
variables, this could lead to unexpected results if env vars were set
when running `yarn version` but not when running `npm publish`.

Fix sidebar app URL in production

The `npm publish` step currently rebuilds the client. Since the `SIDEBAR_APP_URL`
env var was not set in the shell used to do this, the default value of
http://localhost:5000/app.html got used instead of
https://hypothes.is/app.html.

Set SIDEBAR_APP_URL to a sensible default value in dev

Change the SASS processing pipeline to match the h and lms projects. The
purpose of this is cross-project consistency for easier maintenance,
consistent processing of SASS files from the upcoming pattern library
and to enable us to use the new SASS module system [1]

The main changes are:

 - Use Dart Sass (the canonical SASS implementation) instead of node-sass.

   This removes a native dependency which occassionally causes build
   headaches (eg. when the installed Node version changes) and will also enable
   us to make use of the new SASS module system.

 - Use a small utility module, `create-style-bundle.js`, that calls the SASS
   compiler directly instead of using gulp plugins. This simplifies
   understanding the build process by removing dependencies and is
   consistent with the h and lms projects.

   This module was copied from the hypothesis/lms repo and modified to
   add the `postcss-url` URL rewriting plugin that the previous
   gulp-sass based pipeline had.

[1] http://sass.logdown.com/posts/7858341-the-module-system-is-launched

It needs the envvar HOME

Use the copy of gulp that's already installed in node_modules, instead
of requiring the user to manually install gulp on their system. We
already do this with gulp in the rest of our apps.

Fix the production build now that SIDEBAR_APP_URL no longer defaults to
production h.

Set SIDEBAR_APP_URL to work with your local dev instance of h by default
in dev.

This is in line with the rest of our apps (h, lms, bouncer, via): when
run in dev they default to working with the dev instances of the others
app, not the production ones.

The idea is that, when setting up all the apps in a dev env, you just
have to install each app and run `make dev` and it will work correctly
with the other dev apps. Some apps also require a `make devdata` command
if they need sensitive DB contents and/or envvars.

Don't require developers to have to set lots and lots of envvars in each
individual project.

I also deleted some docs that instructed people to create authclients,
and set envvars, that are already automated in h.

Improve `aria-label` on annotation tags

Improve contrast on tags
Fix a bug where the link hover color was not working in some cases

Add ES2015 polyfills required by new Sentry SDK

Add missing polyfills required by new Sentry SDK under IE 11 as per the
"Support for <= IE 11" section at
https://docs.sentry.io/platforms/javascript/#browser-table. In
particular the `String.prototype.includes` polyfill was missing and
causing the application to fail to load fully.

Fixes #1391

Bump commander from 3.0.1 to 3.0.2