The documentation for the `on` and `call` are documented identically as
in the `Bridge` class and use the same nomenclature.

We previously implemented a custom confirm dialog for use in browsers
which disallow use of `window.confirm` in cross-origin iframes (Chrome 9x) but
kept `window.confirm` in other browsers while the design of the new
dialogs was polished.

The polishing has now been done, so this commit switches all confirm
dialogs to use the new dialogs. This makes the experience look better
and be consistent across browsers.

No functional change.

The added type has surfaced that `iframe.contentDocument` could be
`null`. This was no considered before. I didn't deviated from the
original behaviour and I casted the value. If in the future we found
issues we should see those in the Sentry reports.

Add information to Sentry error reports about what JavaScript files were
included on the page.

I have a hypothesis that Sentry issues like
https://sentry.io/organizations/hypothesis/issues/2528337318/events/e176f165836149b99d439fa71e69453c/?project=69811&query=is%3Aunresolved
might be caused by unwanted `<script>` tags injected by extension or the browser.
We try to block most unexpected scripts using strict
Content-Security-Policy settings, but extension and custom
browser-injected scripts may be able to bypass this.

Remove the query-string dependency and disallow use of Browserify's
querystring package. Going forwards all query string construction and
parsing should be done with URLSearchParams.

Replace remaining use of query-string dependency with the
URLSearchParams browser API. This will allow us to remove the
dependency.

Wherever the client calls `Response.json()` it should handle the
scenario where the body is empty.

Refactor a lengthy promise chain in the function that executes API
calls to use async/await instead, to make it easier to follow the
control flow.

Implemented an internal flag in the `AnnotationSync` class that keeps
track of whether destroy has been called. When the `AnnotationSync` is
destroyed, messages from the sidebar are ignored.

In addition, we have made the bridge handlers to return `undefined` for
the results because they are not used in the reciprocal bridge channel.

`guestConfig` was not used, so I deleted it.

Improved text descriptions specifying the origin of the events.

`CrossFrame` created an emitter and wrapped the `subscribe` and
`publish` methods into two functions that were passed as arguments to
the `AnnotationSync`'s constructor.

A simpler and more direct approach is to pass the event bus directly to
`AnnotationSync`.

The previous version stated that it aimed to match the behavior of the
`query-string` package but it was actually tested against Node's
`querystring` package, which has slightly different behavior for this
edge case. It omits parameters with `undefined` values and renders empty
parameters for `null` values.

The notebook view was calling `api.search({ uri: undefined, ... })` and
this translated to `/api/search?uri=&...` which caused an error.

Omit parameters instead in this case.

The Notebook view failed to show results because the parameters passed
to the API search call included `{ uri: undefined }` and the logic for
serializing parameters failed to handle this, so the search API call was
not made.

This commit makes the handling of nullish values in API method calls
match the previous behavior and adds a test.

This is a step towards eliminating a dependency in favor of a native
browser API.

Replace this dependency with a native browser API which we can now use.

Bumps [axe-core](https://github.com/dequelabs/axe-core) from 4.3.1 to 4.3.2.
- [Release notes](https://github.com/dequelabs/axe-core/releases)
- [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/dequelabs/axe-core/compare/v4.3.1...v4.3.2)

---
updated-dependencies:
- dependency-name: axe-core
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [commander](https://github.com/tj/commander.js) from 8.0.0 to 8.1.0.
- [Release notes](https://github.com/tj/commander.js/releases)
- [Changelog](https://github.com/tj/commander.js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tj/commander.js/compare/v8.0.0...v8.1.0)

---
updated-dependencies:
- dependency-name: commander
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [eslint](https://github.com/eslint/eslint) from 7.31.0 to 7.32.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.31.0...v7.32.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@octokit/rest](https://github.com/octokit/rest.js) from 18.7.1 to 18.7.2.
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](https://github.com/octokit/rest.js/compare/v18.7.1...v18.7.2)

---
updated-dependencies:
- dependency-name: "@octokit/rest"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@babel/preset-env](https://github.com/babel/babel/tree/HEAD/packages/babel-preset-env) from 7.14.8 to 7.14.9.
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v7.14.9/packages/babel-preset-env)

---
updated-dependencies:
- dependency-name: "@babel/preset-env"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [core-js](https://github.com/zloirock/core-js) from 3.15.2 to 3.16.0.
- [Release notes](https://github.com/zloirock/core-js/releases)
- [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zloirock/core-js/compare/v3.15.2...v3.16.0)

---
updated-dependencies:
- dependency-name: core-js
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [sass](https://github.com/sass/dart-sass) from 1.36.0 to 1.37.0.
- [Release notes](https://github.com/sass/dart-sass/releases)
- [Changelog](https://github.com/sass/dart-sass/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sass/dart-sass/compare/1.36.0...1.37.0)

---
updated-dependencies:
- dependency-name: sass
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.953.0 to 2.958.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.953.0...v2.958.0)

---
updated-dependencies:
- dependency-name: aws-sdk
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Suppress various errors that can occur due to transient network issues
or unusual or old browsers. This helps improve the signal-to-noise ratio
of reports in Sentry.

Some of the transient network errors could be caught and handled more gracefully.
However for the moment suppressing them will allow us to focus on more
important crashes.

Extracted from https://github.com/hypothesis/client/pull/3589

Add a test case for tall iframes where the height of the frame is set to
match the document height. This mimics how the new VitalSource Bookshelf
reader presents book content. See
https://github.com/hypothesis/client/issues/3590#issuecomment-886229080

mustache-express caches templates by default unless Express's `view
cache` option is explicitly set to `false`, as opposed to merely being
unset. This is not mentioned in the documentation :(

I debated whether to replace the mustache-express dependency with a
custom integration. mustache-express does provide support for partials
though which might be useful in future. For future reference, rendering
templates without this dependency would look like:

```js
app.engine('mustache', async (filePath, options, callback) => {
  try {
    const template = await fsPromises.readFile(filePath, {
      encoding: 'utf8',
    });
    const rendered = Mustache.render(template, options);
    callback(null, rendered);
  } catch (err) {
    callback(err);
  }
});
```

The test happened to work without it, but the parameter is ostensibly
required.

We don't want to connect to the sidebar in the parent frame if the
current frame has one.

The previous code assumed that the `window.parent.__hypothesis` access
would return undefined. This assumption was wrong. Instead it triggers
an error.

Handle this error and display a more informative message if a guest
cannot connect to a sidebar.

Without this call the test doesn't execute the code paths it intends to
test.

Use the existing `MessageEvent.ports` property to access transferred
ports instead of adding an extra property to the message itself.

This commit implements the initial transition of communication between
guest/host frames and the sidebar to use `MessageChannel` as the
underlying transport instead of `window.postMessage`, building on
previous changes to the `Bridge` and `RPC` classes.

This change aligns with an ongoing to plan to use `MessageChannel`
instead of `window.postMessage`, and also resolves an issue where guest
frames may fail to connect to the sidebar if the annotator code loads in
the guest before the sidebar application has finished loading.

This initial version has several limitations compared to what is planned
for the final version of the new inter-frame communication system:

 - It only supports guest frames which are the same frame as the host or
   a direct, same-origin child.

 - Sidebar <-> host communication relies on the host frame also being a
   guest frame. In order for the host frame to receive messages from the
   sidebar, it must run the logic to establish sidebar <-> guest communication.
   In other words, it is not possible to have a host frame which cannot
   also be annotated.

 - The only supported roles for frames are sidebar and host/guest. There
   is no separate role for notebook frames for use in notebook <->
   sidebar communication.

Making this change involved replacing the protocol used by guest frames
and the sidebar to discover each other. The new one is simpler than the
previous one and works as follows:

1. When the sidebar application starts up it notifies the parent frame that
   it is ready to connect to guests via a `hypothesisSidebarReady`
   message.

2. Guest frames wait for this notification to be received before
   connecting to the sidebar. When they connect, they create a
   `MessageChannel` and send one port to the sidebar via a
   `hypothesisGuestReady` message and use the other port locally.

3. When the sidebar receives a `hypothesisGuestReady` message it creates
   a channel to communicate with the guest.