Update README

Add embedding label

This is so the h docs can cross-ref to this page using intersphinx.

Now that this git repo has Sphinx docs published at
http://h.readthedocs.io/projects/client/, the README should link to
those.

I also reworded a bit to make it more similar to the intro in the Sphinx
docs.

Reorganise docs

Change the docs directory (which was just a directory of markdown files)
to a reStructuredText / Sphinx project.

Docs are reorganized by audience.

Some docs (for example embedding.rst) are copied over from the h repo's
docs. These will be removed from the h repo after this commit is merged.

These are documentation files intended for publishers who're embedding h
in their sites, they're being removed from the h repo into this client
repo.

There may be some reStructuredText syntax in these files that doesn't
work on GitHub (only in Sphinx or only on readthedocs) but these client
docs are about to be moved over to Sphinx/readthedocs anyway.

Keep all the docs for publishers (i.e. people who run websites that
publish content, and want to embed the h client into their site)
together in one docs/publishers folder.

Edit assetRoot and sidebarAppUrl docs

- Clarify that if any service is specified it's used _instead of_, not
in addition to, the default hypothes.is service

- Add note that services settings are still experimental

- Edit the text for clarity

I still don't think the `authority` setting is very well described here,
but I think that setting may be going away in the future, so I'm not
going to try and document it better right now.

The `grantToken` setting could still do with much better docs as well.

Move the docs for these two config settings into their own section in
the docs, and note that they're experimental.

Rename the onLogin callback to onLoginRequest

Remove sourcemap link from boot script

The previous regex would have matched any line that happened to contain
the text 'sourceMappingURL'.

The trigger for invoking this callback function is the user requesting
that a login flow be started. In other words, at the point this callback
is invoked, a login has not occurred, and indeed may never occur if the
user does not complete the login flow.

As such, it seems clearer to have this callback called "onLoginRequest"
rather than "onLogin."

Fixes #274.

Add docs for on login

"Keys" here is programmer jargon, and hopefully the client configuration
documented on this page should be usable by people who aren't
programmers.

config.md was interchangeably using "sidebar" and "client" to refer to
the client. Fix it to always use "client" because it's more consistent.
I chose client instead of sidebar because (both technically speaking and
in terms of the UI) not all of these settings actually refer to the
sidebar, e.g. showHighlights and assetRoot. Also client is the word used
by the git repo name and in the README file.

For example "Client behavior" was a sibling heading of "Config keys",
not a sub heading as intended. Fix all the heading levels so that
headings are nested as they were intended to be.

Add overview of client security considerations

Add a preliminary overview of client security considerations and
implementation decisions.

Developing docs tweaks

The replacement of var placeholders with values invalidates the
sourcemap locations and the sourcemap URL is invalid after the file is
copied from build/scripts/ to build/. Since the script is tiny the debug
info is not that valuable so this commit just removes the sourcemap URL
to avoid browsers complaining that they cannot retrieve it.

sudo isn't required on all systems (e.g. macos)