Edit assetRoot and sidebarAppUrl docs

- Clarify that if any service is specified it's used _instead of_, not
in addition to, the default hypothes.is service

- Add note that services settings are still experimental

- Edit the text for clarity

I still don't think the `authority` setting is very well described here,
but I think that setting may be going away in the future, so I'm not
going to try and document it better right now.

The `grantToken` setting could still do with much better docs as well.

Move the docs for these two config settings into their own section in
the docs, and note that they're experimental.

Rename the onLogin callback to onLoginRequest

Remove sourcemap link from boot script

The previous regex would have matched any line that happened to contain
the text 'sourceMappingURL'.

The trigger for invoking this callback function is the user requesting
that a login flow be started. In other words, at the point this callback
is invoked, a login has not occurred, and indeed may never occur if the
user does not complete the login flow.

As such, it seems clearer to have this callback called "onLoginRequest"
rather than "onLogin."

Fixes #274.

Add docs for on login

"Keys" here is programmer jargon, and hopefully the client configuration
documented on this page should be usable by people who aren't
programmers.

config.md was interchangeably using "sidebar" and "client" to refer to
the client. Fix it to always use "client" because it's more consistent.
I chose client instead of sidebar because (both technically speaking and
in terms of the UI) not all of these settings actually refer to the
sidebar, e.g. showHighlights and assetRoot. Also client is the word used
by the git repo name and in the README file.

For example "Client behavior" was a sibling heading of "Config keys",
not a sub heading as intended. Fix all the heading levels so that
headings are nested as they were intended to be.

Add overview of client security considerations

Add a preliminary overview of client security considerations and
implementation decisions.

Developing docs tweaks

The replacement of var placeholders with values invalidates the
sourcemap locations and the sourcemap URL is invalid after the file is
copied from build/scripts/ to build/. Since the script is tiny the debug
info is not that valuable so this commit just removes the sourcemap URL
to avoid browsers complaining that they cannot retrieve it.

sudo isn't required on all systems (e.g. macos)

For example Node is a prerequisite because we just tell you that you're
going to need it before you can follow these instructions. Gulp is not a
prerequisite, it's a dependency, because the instructions tell you how
to install it.

This OS-specific dependency was inadvertently added to the shrinkwrap in
ed4afca0

Add eslint rule to raise a warning if any of the tests are using the …

Add a guide to developing the Hypothesis client

Add an initial guide to developing the Hypothesis client, covering:

 - Installation
 - Getting a local build of the client working with the browser
   extension or a local Hypothesis service
 - Running tests
 - Some basic pointers on code style and where to find guidance for
   creating pull requests

This guide assumes that the service is configured to use the client's
new boot script.

Add tests for login control.