Close #2097

I'm not sure where I got the number that was here, but it's not the
well-known maximum value for any browser.

Since our div is likely to be one of the last in the document, by
virtue of being dynamically injected after DOMReady, close #1909.

Break out client configuration into a Bundle

Distinguish brand color from error color

Overhaul URI analysis

We don't want our brand to be associated with errors and warnings
by virtue of using the same colors for both.

This clarifies things a bit by choosing a suitable orange red for
the error base.

As an additional touch-up for the colors this adds a function to
do return color "weights" giving color values similar to those in
Google's Material Design color palettes.

In this manner, the client configuration is made more easily
replaceable in downstream deployments through the asset configuration.

Additionally, code shared between the various application pages that
configures the identity and session providers for our account system
lives in one place holding those cross-cutting concerns.

No need to reload on search for that route, either.

Otherwise, we reload for any change of query string or hash, rather
than just on the q parameter.

Somehow this wasn't a problem before, but now it is. Some files have
a BOM (jquery scrollintoview plugin is one) and browserify typically
strips these, but only if they are at the beginning of the stream.
With browserify-shim, the BOM will be inside the IFFE.

moment(um)-timezone-data

This change gives every minified output bundle an un-minified
counterpart.

Rather than having some CSS lingering in directories like the static
base (icomoon) or vendored scripts (toastr, katex), create a dedicated
place for these under h/static/styles/vendor.

Icomoon and Katex fit together nicely, combining the font folders.

This commit also sees the re-introduction of the cssrewrite filter
to ensure that the relative URLs are properly rebased.

Hack around lack of messageThread prototype

Fix #2182

[WIP] Re-add "scroll to new annotation" feature

This reverts commit ba68d710b84d2a78426fd6c0ed325e8c40cbbca1.

Logically, it makes sense to prevent double _embedding_ in the embed
code.

Also, there may come a time when it's acceptable and possible to
instantiate the application multiple times for different parts of a
document.

Finally, this prevents loading CSS and polyfills twice, as well.

This should speed up the stream and ensure that results coming back
from the server are not filtered out due to a mismatch between the
page search and elasticsearch query treatment.

Close #2175

This change also means that the application actually starts after
the `noConflict` calls have erased any trace of Annotator or jQuery
from the global object.

AnnotationSync was using $.extend. Since I don't want to depend on
jQuery in the widget application indefinitely and I don't want to
depend on Annotator either there is not a single place to get this
function that works in both environments. Instead, a single purpose
module from NPM for extend is pulled in. Small modules FTW.

Add a blocklist of sites we don't launch on

Center icons in toolbar buttons.

Get Promise explicitly through requires