Distinguish brand color from error color

Overhaul URI analysis

We don't want our brand to be associated with errors and warnings
by virtue of using the same colors for both.

This clarifies things a bit by choosing a suitable orange red for
the error base.

As an additional touch-up for the colors this adds a function to
do return color "weights" giving color values similar to those in
Google's Material Design color palettes.

No need to reload on search for that route, either.

Otherwise, we reload for any change of query string or hash, rather
than just on the q parameter.

Somehow this wasn't a problem before, but now it is. Some files have
a BOM (jquery scrollintoview plugin is one) and browserify typically
strips these, but only if they are at the beginning of the stream.
With browserify-shim, the BOM will be inside the IFFE.

moment(um)-timezone-data

This change gives every minified output bundle an un-minified
counterpart.

Rather than having some CSS lingering in directories like the static
base (icomoon) or vendored scripts (toastr, katex), create a dedicated
place for these under h/static/styles/vendor.

Icomoon and Katex fit together nicely, combining the font folders.

This commit also sees the re-introduction of the cssrewrite filter
to ensure that the relative URLs are properly rebased.

Hack around lack of messageThread prototype

Fix #2182

[WIP] Re-add "scroll to new annotation" feature

This reverts commit ba68d710b84d2a78426fd6c0ed325e8c40cbbca1.

Logically, it makes sense to prevent double _embedding_ in the embed
code.

Also, there may come a time when it's acceptable and possible to
instantiate the application multiple times for different parts of a
document.

Finally, this prevents loading CSS and polyfills twice, as well.

This should speed up the stream and ensure that results coming back
from the server are not filtered out due to a mismatch between the
page search and elasticsearch query treatment.

Close #2175

This change also means that the application actually starts after
the `noConflict` calls have erased any trace of Annotator or jQuery
from the global object.

AnnotationSync was using $.extend. Since I don't want to depend on
jQuery in the widget application indefinitely and I don't want to
depend on Annotator either there is not a single place to get this
function that works in both environments. Instead, a single purpose
module from NPM for extend is pulled in. Small modules FTW.

Add a blocklist of sites we don't launch on

Center icons in toolbar buttons.

Get Promise explicitly through requires

The blocklist is configured in production.ini like so:

    h.blocklist = {
        "seanh.cc": {},
        "finance.yahoo.com": {},
        "twitter.com": {}
    }

The Chrome extension handles the blocklist in the same way that it
handles other launch errors (e.g. when the user hasn't given the
extension permission to annotate file:/// URLs): it adds a (!) error
badge to the "browser action" button, if the button is clicked again it
opens a "help" page saying that the site isn't supported yet.

It doesn't seem to be possible to pass data into the Chrome extension's
help pages (as far as I can tell) so the error is just "Hypothesis
doesn't work on this page yet" and not e.g. "Hypothesis doesn't work on
twitter.com".

The bookmarklet handles the blocklist in the same way that it handles
other launch errors (e.g. trying to annotate a PDF when PDF.js isn't
available): it uses window.alert() to show an error.

This eliminates a lot of polyfill cruft. Also, we had two different
promise polyfills in the vendor directory (O.o).

Close #2164

This reverts commit 04504dca0b36cffd57d3fd7fe071fd1ef52079b0.

Re-add protection against double deployment