Enable feature flagged highlighter interface

Fix sidebar app failing to load in Firefox extension.

`Sidebar` no longer handles the click/touchstart on the document itself, therefore the test for this was replaced with a
 test in `Guest`, a test for if it’s sending “hideSidebar” event via `CrossFrame` when the document is clicked

Convert "flash" service to JS

Enable feature flagging in the annotation layer

Angular has a check for Chrome Packaged Apps in its `$sniffer` service
which changes the behavior of the $location service and in the Firefox
extension, triggers a redirect from `/client/app.html` to
`/#client/app.html` on startup, breaking the sidebar app.

This commit works around the problem by adding a fake
`window.chrome.app` object to convince Angular that the Firefox
extension is not a Chrome Packaged App.

Issue reported upstream at https://github.com/angular/angular.js/issues/16068

Remove `angular.bind` dependency since `Function.prototype.bind` is now
ubiquitous.

Upgrade Sinon.JS to its latest version

Rename config.app to sidebarAppUrl

The code in `src/boot/` reads the `sidebarAppUrl` setting from
`js-hypothesis-config` JSON objects in the host page (defaulting to the
value of the build-time `__SIDEBAR_APP_URL__` template variable, if there's
no `sidebarAppUrl` setting in the host page).

`boot/` then writes `sidebarAppUrl` as the value of the `href` of a
`<link type="application/annotator+html">` element that it injects into
the host page.

Later, the code in `src/annotator/` reads this `<link>` element's `href`
in as the `config.app` setting, which it uses as the `src` of the
sidebar app's `<iframe>` that it injects into the host page.

So the variable that's named `sidebarAppUrl` / `__SIDEBAR_APP_URL__` at
boot / build time* gets renamed to `config.app` when it makes it into
the `src/annotator` code.

Fix this by renaming `config.app` in `src/annotator` to
`config.sidebarAppUrl` so that the variable is named consistently.

`*` In the build-time code there's also a `defaultSidebarAppUrl`
variable, and an `H_SERVICE_URL` environment variable, which also belong to
the same sidebarAppUrl config setting.

Add showHighlights() settings function

Return null, rather than undefined, if a host page setting isn't defined
in the host page.

This is because null, rather than undefined, is commonly used in this
codebase to explicitly denote "not found".

strictEqual() can tell the difference between null and undefined,
whereas equal() can't.

Rename H_SERVICE_URL to SIDEBAR_APP_URL

This groups all of the logic for the config.showHighlights setting (both
how it's read from the host page, and how the host page's value is
transformed afterwards) into one unit-tested place.

The `H_SERVICE_URL` environment variable is only used for one thing: to
set the value of the `defaultSidebarAppUrl` variable (to
https://hypothes.is/app.html in production or localhost:5000/app.html in dev)
by appending `/app.html` to the end of the environment variable's value.

For consistency with the config setting and variables that it's used to
control, rename `H_SERVICE_URL` to `SIDEBAR_APP_URL` and require the
user to include the `/app.html` ending in the environment variable's
value.

Also rewrite the documentation for this environment variable to make it
clearer what it's used for.

**Note**: This change means that developers who're using the
`H_SERVICE_URL` environment variable in their development environments
will need to:

1. Rename `H_SERVICE_URL` it to `SIDEBAR_APP_URL` in their environment
2. Append `/app.html` to the end of the environment variable's value

For example:

    export SIDEBAR_APP_URL="http://localhost:5000/app.html"

The developer docs for this environment variable have been updated to reflect
this.

Remove assetRoot and sidebarAppUrl from annotator

Remove the assetRoot and sidebarAppUrl config settings, which are read
from js-hypothesis-config objects in the host page, from the
src/annotator code.

These settings aren't used in the src/annotator code, they're used in
the src/boot code only.

Convert shared Bridge class to JS

Fix warning about loading Angular twice in tests

Convert localStorage service to JS

Remove unused "host" service

This reverts commit 4521cb4d.

Add --force to yarn install command

Attempting to fix this error with the client build on Jenkins:

    Error during loading "/data/jenkins/workspace/client_master-*/node_modules/karma-phantomjs-launcher" plugin:
      Path must be a string. Received null