Add deprecation notice for IE11 browsers

Remove unused/unnecessary SASS vars and mixins

- Remove unnecessary clearfix in annotation-header. We don't use floats
  in the layout of annotation threads or annotations any more.

- Remove unused variables

- Remove an unused mixin in `forms.scss`

Rectify infinite load on single-annotation, stream views

Bump mocha from 7.1.2 to 7.2.0

Bump karma from 5.0.8 to 5.0.9

Bump terser from 4.6.13 to 4.7.0

Bump fetch-mock from 9.9.0 to 9.10.1

Bump preact from 10.4.1 to 10.4.4

Fix installing tox

Update 3 config keys

- `allowLeavingGroups`
- `groups` when used with “$rpc:requestGroups” value
- `requestConfigFromFrame`

Our scripting automatically installs tox in pyenv so you don't have to
install tox manually or system-wide. Unfortunately it wasn't working:
the installed tox doesn't appear on your PATH until you run a
`pyenv rehash`

Bump chance from 1.1.5 to 1.1.6

Remove `OAUTH_TOKENS_CHANGED` event

Remove unused diff-match-patch dependency

We don't use this package directly any more, although there is still a
transitive dependency on it via dom-anchor-text-quote.

Bumps [aws-sdk](https://github.com/aws/aws-sdk-js) from 2.679.0 to 2.683.0.
- [Release notes](https://github.com/aws/aws-sdk-js/releases)
- [Changelog](https://github.com/aws/aws-sdk-js/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js/compare/v2.679.0...v2.683.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [@octokit/rest](https://github.com/octokit/rest.js) from 17.9.1 to 17.9.2.
- [Release notes](https://github.com/octokit/rest.js/releases)
- [Commits](https://github.com/octokit/rest.js/compare/v17.9.1...v17.9.2)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [preact](https://github.com/preactjs/preact) from 10.4.1 to 10.4.4.
- [Release notes](https://github.com/preactjs/preact/releases)
- [Commits](https://github.com/preactjs/preact/compare/10.4.1...10.4.4)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [terser](https://github.com/terser/terser) from 4.6.13 to 4.7.0.
- [Release notes](https://github.com/terser/terser/releases)
- [Changelog](https://github.com/terser/terser/blob/master/CHANGELOG.md)
- [Commits](https://github.com/terser/terser/compare/v4.6.13...v4.7.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [chance](https://github.com/chancejs/chancejs) from 1.1.5 to 1.1.6.
- [Release notes](https://github.com/chancejs/chancejs/releases)
- [Commits](https://github.com/chancejs/chancejs/compare/1.1.5...1.1.6)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [mocha](https://github.com/mochajs/mocha) from 7.1.2 to 7.2.0.
- [Release notes](https://github.com/mochajs/mocha/releases)
- [Changelog](https://github.com/mochajs/mocha/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mochajs/mocha/compare/v7.1.2...v7.2.0)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [karma](https://github.com/karma-runner/karma) from 5.0.8 to 5.0.9.
- [Release notes](https://github.com/karma-runner/karma/releases)
- [Changelog](https://github.com/karma-runner/karma/blob/master/CHANGELOG.md)
- [Commits](https://github.com/karma-runner/karma/compare/v5.0.8...v5.0.9)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Bumps [fetch-mock](https://github.com/wheresrhys/fetch-mock) from 9.9.0 to 9.10.1.
- [Release notes](https://github.com/wheresrhys/fetch-mock/releases)
- [Commits](https://github.com/wheresrhys/fetch-mock/compare/v9.9.0...v9.10.1)
Signed-off-by: dependabot-preview[bot] <support@dependabot.com>

Co-authored-by: Kyle Keating <kkeating@hypothes.is>

Co-authored-by: Kyle Keating <kkeating@hypothes.is>

* Add `aria-expanded` to sidebar show/hide button

* Add axe test to annotator toolbar component
Co-authored-by: Kyle Keating <kkeating@hypothes.is>

Use `aria-expanded` instead of `aria-pressed` per a11y audit

Remove the last remaining use of the `$rootScope` service to broadcast /
subscribe to the `OAUTH_TOKENS_CHANGED` event.

Instead the `auth` service is now an `EventEmitter` and the `session`
service subscribes directly to `oauthTokensChanged` events from it.
Whereas we replaced most other events with observers which react to data
changing in the store, this particular use case doesn't lend itself to
that and it makes more sense for the `auth` service to emit events to
notify interested consumers.

Replace the `BEFORE_ANNOTATION_CREATED` event