In #4195, we removed `clearSelectionExceptIn` RPC event. Instead, the
host frame sends `clearSelection` RPC events to specific guest frames.

The `hasHypothesis` function always returned false because it relied on a global
variable that no longer exists. The fact that it was broken didn't cause
noticeable problems because the client's boot script also has a check for
whether Hypothesis is already injected.

Replace the broken check with a working one that corresponds to the nearby
`injectHypothesis` function.

Bumps [eslint](https://github.com/eslint/eslint) from 8.8.0 to 8.9.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.8.0...v8.9.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [karma](https://github.com/karma-runner/karma) from 6.3.15 to 6.3.16.
- [Release notes](https://github.com/karma-runner/karma/releases)
- [Changelog](https://github.com/karma-runner/karma/blob/master/CHANGELOG.md)
- [Commits](https://github.com/karma-runner/karma/compare/v6.3.15...v6.3.16)

---
updated-dependencies:
- dependency-name: karma
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [tailwindcss](https://github.com/tailwindlabs/tailwindcss) from 3.0.18 to 3.0.22.
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/master/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/compare/v3.0.18...v3.0.22)

---
updated-dependencies:
- dependency-name: tailwindcss
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@rollup/plugin-replace](https://github.com/rollup/plugins/tree/HEAD/packages/replace) from 3.0.1 to 3.1.0.
- [Release notes](https://github.com/rollup/plugins/releases)
- [Changelog](https://github.com/rollup/plugins/blob/master/packages/replace/CHANGELOG.md)
- [Commits](https://github.com/rollup/plugins/commits/yaml-v3.1.0/packages/replace)

---
updated-dependencies:
- dependency-name: "@rollup/plugin-replace"
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@sentry/browser](https://github.com/getsentry/sentry-javascript) from 6.17.4 to 6.17.7.
- [Release notes](https://github.com/getsentry/sentry-javascript/releases)
- [Changelog](https://github.com/getsentry/sentry-javascript/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-javascript/compare/6.17.4...6.17.7)

---
updated-dependencies:
- dependency-name: "@sentry/browser"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [puppeteer](https://github.com/puppeteer/puppeteer) from 13.1.3 to 13.3.1.
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](https://github.com/puppeteer/puppeteer/compare/v13.1.3...v13.3.1)

---
updated-dependencies:
- dependency-name: puppeteer
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [@sentry/cli](https://github.com/getsentry/sentry-cli) from 1.72.1 to 1.72.2.
- [Release notes](https://github.com/getsentry/sentry-cli/releases)
- [Changelog](https://github.com/getsentry/sentry-cli/blob/master/CHANGELOG.md)
- [Commits](https://github.com/getsentry/sentry-cli/compare/1.72.1...1.72.2)

---
updated-dependencies:
- dependency-name: "@sentry/cli"
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [rollup](https://github.com/rollup/rollup) from 2.67.1 to 2.67.2.
- [Release notes](https://github.com/rollup/rollup/releases)
- [Changelog](https://github.com/rollup/rollup/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rollup/rollup/compare/v2.67.1...v2.67.2)

---
updated-dependencies:
- dependency-name: rollup
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

PDFjs' CSS sets `font-size: 10px` on the `html` element. This sets
1rem = `10px` which is tiny. Our styles work in rem units for spacing,
so padding, margins, etc. are too tight with that `10px` base size.

Set `html` font-size back to 100% for now. This does not have any
apparent effect on PDFjs styling, as `body` sets `font-size: 16px`
anyway.

See https://github.com/mozilla/pdf.js/issues/14555

For simplicity, combine `prefix` and `delimiter` into a single argument.

This property is already set when frames are added to the fake store.

The result of `store.frames()` needs to be kept in sync with
`store.connectFrame()` and `store.destroyFrame()` calls. Change the way
these methods are faked in the FrameSyncService tests to ensure this
happens.

Handle the case when an annotation is returned from the backend whose URL does
not match the frame URL and where there is no "main" guest frame. This can
happen in VitalSource, where no guest is created in the host frame.

The general solution to this is to change the client and h so that it can always
determine which query URL an annotation from h matched. See [1]. This is an
interim step which will work in VitalSource and similar scenarios.

[1] https://github.com/hypothesis/client/issues/4191

The new order feels more logical,
`attributeName="{prefix}{delimiter}..."`:

1. attribute name to be parsed in the metatags
2. prefix
3. delimiter

If the meta tag contains a empty `content` attribute it is ignored.
Example: `<meta name="citation_doi" content>`

Closes https://github.com/hypothesis/product-backlog/issues/1290

Respect the original (pre-tailwind) z-index scale, which is 1, 2, 3 vs
Tailwind's 10, 20, 30, etc.

Convert the `AdderToolbar` component to tailwind utility-first styles.

This component has some styling complexity that requires the continued
use of some external styles for now:

* It serves as the root element in a shadow DOM and has a couple of
  reset rules not serviceable by tailwind utility classes
* The hover behavior of the adder toolbar buttons is too complex to
  implement with utility styles alone.

Visual differences before/after are negligible. The adder is 1px taller
due to using standardized spacing.

 - Type the `state` parameter to reducers and selectors

 - Improve types for `initializeAnnotation` helper

 - Add missing checks for the `id` field being set

 - Specify that `savedAnnotations` returns only annotations that have an
   ID

 - Introduce a `SavedAnnotation` type to represent annotations which
   have definitely been saved and an associated `isSaved` function to
   test. Use this as the type for several methods which used to
   implicitly assume they were passed a saved annotation.

   Calls to `isSaved` have also been added in several places to check
   that an annotation has been saved, although this should always have
   been the case in practice.

 - Add missing annotation types to various parameters in
   `AnnotationsService`

[Based on this comment](https://github.com/hypothesis/client/pull/3903/files#r751261292)
I moved the logic to show the sidebar UI with other sidebar RPC event
listeners.

After #4176, the 'create note' button has stopped working in
VitalSource. That's because we don't create the guest frame in the host
frame. Creating a note relayed on one of the guest frames having a
frameIdentifier` with value `null`. That's not longer the case.

Now, when creating a page note we send the request to the first
connected guest frame. This is analogous to #4177.

In addition, we only send `textUnselected`, `textSelected` and
`createAnnotation` RPC events to only specific guest frames. That
simplifies the logic by avoiding to send a `frameIdentifier`.

The new built-in "connect" PortRPC event (see #4175) makes the `ready`
RPC event redundant. The host frame now uses the `connect` event to know
when the sidebar frame is connected, and hence display it.

 - Use asserts to verify that "close" events are not emitted earlier
   than they should be, rather than blindly resetting the close event
   listener stub.
 - Reset the sinon sandbox after each test to ensure any DOM APIs are
   unmocked

Add two built-in events to PortRPC which are dispatched when PortRPC connects to
a port and when it is destroyed or the containing frame is unloaded. These
events can be used in the counterpart PortRPC to confirm that the sender has
successfully received and connected to the port, and to get notified when the
port goes away.

Sending the "close" event in the context of a window unloading in Safari
<= 15 requires a workaround that involves registering a handler in the
parent frame. This handler is currently installed only in the host frame.

The new "close" event is used to replace the "frameDestroyed" message
that was used by guests to notify the sidebar when it went away. This solves
several problems:

 - It centralizes the workaround for https://bugs.webkit.org/show_bug.cgi?id=231167
   in `post-rpc.js`, instead of having it spread between several
   modules.

 - It provides a way to tear down the guest-host connection when the
   guest goes away.

 - It provides a way to handle the case where a guest is unloaded before it
   has received and connected to the port, by having the host/sidebar frames
   expect the "connect" call within a timeout. This is not yet implemented.

Since all message types now include this property, we can check for it
in `isMessage` instead of requiring a separate check.

PortProvider previously used a `WeakMap<Window, Set<Channel>>` to keep
track of which ports had been requested from a particular source frame,
where the map keys came from `MessageEvent.source`. A problem with this
approach is that for messages from an iframe, `MessageEvent.source` refers to a
`WindowProxy` which retains the same identity across page navigations.
As a result if a guest iframe was navigated to a new page which also
embedded the client as a guest (or into which the client was
subsequently injected as a guest), the guest in the new document would
not be able to retrieve any ports.

Implement a fix whereby each call to `PortFinder.discover` generates a
random request ID which is sent with the initial port request plus any
re-sent requests. PortProvider then keeps track of the request IDs it
has seen and ignores messages with a previously seen request ID.

This change would also fix port discovery if the guest in a frame was
unloaded and later re-loaded.

Bumps [postcss](https://github.com/postcss/postcss) from 8.4.5 to 8.4.6.
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.4.5...8.4.6)

---
updated-dependencies:
- dependency-name: postcss
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [axe-core](https://github.com/dequelabs/axe-core) from 4.3.5 to 4.4.1.
- [Release notes](https://github.com/dequelabs/axe-core/releases)
- [Changelog](https://github.com/dequelabs/axe-core/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/dequelabs/axe-core/compare/v4.3.5...v4.4.1)

---
updated-dependencies:
- dependency-name: axe-core
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [karma](https://github.com/karma-runner/karma) from 6.3.12 to 6.3.15.
- [Release notes](https://github.com/karma-runner/karma/releases)
- [Changelog](https://github.com/karma-runner/karma/blob/master/CHANGELOG.md)
- [Commits](https://github.com/karma-runner/karma/compare/v6.3.12...v6.3.15)

---
updated-dependencies:
- dependency-name: karma
  dependency-type: direct:development
  update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [core-js](https://github.com/zloirock/core-js) from 3.20.3 to 3.21.0.
- [Release notes](https://github.com/zloirock/core-js/releases)
- [Changelog](https://github.com/zloirock/core-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zloirock/core-js/compare/v3.20.3...v3.21.0)

---
updated-dependencies:
- dependency-name: core-js
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.1066.0 to 2.1069.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.1066.0...v2.1069.0)

---
updated-dependencies:
- dependency-name: aws-sdk
  dependency-type: direct:development
  update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>