Enable third-party authorities to globally disable annotation share links

In the context of the LMS app, the client is embedded inside a Via iframe, which
is inside an LMS app iframe, which is inside Canvas. There is currently no
mechanism in place to propagate the focused annotation down the frame hierarchy.
As a result, share links show up but do not work.

As a simple way to resolve that for an initial version of the LMS app, provide
it with a way to globally disable annotation share links.

In future we may move this responsibility to the "h" service, so that the
availability (or not) of share links is correctly reflected in h API responses.

Part of https://github.com/hypothesis/product-backlog/issues/843

Support recent versions of PDF.js

Recent versions of PDF.js emit a "documentloaded" event when the document
finishes loading. Older versions emit "documentload". Listen for both events to
support both versions.

`PDFViewerApplication.documentFingerprint` was removed in recent
versions of PDF.js [1]. This issue causes loading the bookmarklet into
Firefox 63+ to fail because the client thinks the PDF is still loading.

`PDFViewerApplication.pdfDocument.fingerprint` is the replacement
mentioned in the commit that removed the property and it also appears to
be more clearly a part of PDF.js' documented API.

This change is backwards-compatible with the version of PDF.js that
currently ships with Via.

[1] https://github.com/mozilla/pdf.js/commit/e522b2d87e8eb3d4eb8a391a098a0f6f157e8c12

Use a class which provides a consistent fake PDFViewerApplication
implementation for use by different PDF metadata tests. This will make
it easier to change the fake in order to reflect changes in PDF.js' API,
or the parts of it that we use.

Fix build under Node 11

Upgrade `natives` indirect dependency using method described at
https://github.com/yarnpkg/yarn/issues/4986#issuecomment-395036563.

See also: https://github.com/isaacs/natives/issues/14

WIP bot configuration

This is an attempt to prevent accidental merging of fixup commits.

See https://github.com/wip/app#configuration

Use atomic git push during release process

Ensure that the release tag is only pushed to GitHub if the release
commit can also be pushed to master.

We are likely to change the release process soon to avoid the need to
push to master at all (see https://github.com/hypothesis/client/issues/810)
but in the meantime this prevents a scenario where:

 - A tag vX.Y.Z gets created
 - The package version is still at X.Y.(Z-1) on master
 - Subsequent builds of master fail because they try and fail to create
   a tag vX.Y.Z which already exists

Disable CoffeeScript support when building sidebar application

All of the modules and tests for the sidebar app that were written in
CoffeeScript have either been removed or converted to JS.

Disable CoffeeScript support when building the sidebar bundle and stop
searching for tests written in CoffeeScript in the src/shared/ and
src/sidebar directories.

Rewrite used parts of stream-filter.coffee in JS

Convert discovery.coffee to JS

Convert shared/discovery tests to JS

Add `make docs` and `make checkdocs`

Add postMessage config delivery example page

Convert viewFilter tests to JS

Deleted the "docs for how to build the docs" since this is now just a
simple `make docs`, as for all our projects.

`setMatchPolicyIncludeAny` no longer exists and is not needed since it
is the _only_ match policy.

This test case reproduces usage of `streamFilter` in
annotation-viewer-content, where the operator is "equals" not "exactly".

Remove support for real-time updates in the /stream view

It is not particularly clear from the naming of these modules what they
are for and how they relate to things the user can do in the
application. Add some comments to clarify this.

Convert the tests for the `viewFilter` class to JS. This is mostly a
straightforward conversion except that `viewFilter.fields` has been made
a private variable and the direct tests for ithave been removed, since the
contents of this field were an implementation detail of the class.

This is straight manual conversion of tests for the `Discovery` class to
JS.

Add notes to `Discovery` class docs that provide an overview of the
current discovery protocol.

Adjust spinner positioning and convert to component

We need to fix these, but for now I'm just making a note about the
issue.

 - Convert `Discovery` class to JS and improve the documentation. This
   is a manual conversion.

 - Rename private `_generateToken` method to `generateToken` because it
   is currently used by cross-frame.coffee. It should really be a
   utility method or cross-frame.coffee could use a different method to
   generate the ID.

Port stream-filter.coffee to JS and add tests, but only for the
functionality that we actually still use in the app. Following the
removal of support for real-time updates in the stream, the websocket is
only configured to filter by URI, annotation ID or reply IDs
("references") in the sidebar and standalone annotation viewer.