A couple of related improvements to how we build the Dockerfile:

1. Don't invalidate the Python dependencies layer just because
   `package.json`, `gulpfile.js` or `scripts/` changed.
2. Use a prebuilt node-sass binary. The prebuilt binaries supplied by
   the node-sass project aren't compatible with Alpine Linux (which uses
   musl-libc rather than glibc).
3. Make some small tweaks to the gulpfile so we can build just the
   assets needed for the web application (i.e. skipping the extension).

Add "bouncer" support to Chrome extension

Postgres documents

Streamer work queue

Remove unnecessary dependency on YAML

Fix form button background gradient

Remove unused '...' which were originally variable
arguments to the compass 'linear-gradient()' mixin.

Now we are just using the linear-gradient() CSS function
however so the '...' was never expanded, resulting in
invalid CSS.

New front-end build system based on Gulp

 - Correct the image reference to be valid with the new build
   system, where styles are served at /assets/styles and
   images under /assets/images.

 - Use @include rather than @extend per current CSS
   conventions for H

This check is already performed in scripts/polyfills.js

This fixes an issue where duplicate sourcemaps were
created for modules which had Browserify shims applied to them such
as annotator.js and annotator.document.js. The duplicated
sourcemaps were not stripped from the bundle by exorcist,
resulting in a much larger production build than necessary.

Some development dependencies were listed in 'dependencies'
and others were listed in 'devDependencies'.

This makes package.json consistent by listing everything
that is either required to build the client
in 'dependencies' and everything else in 'devDependencies'.

This also removes several unused dependencies.

The change in e5bf6d1e to use the same Promise polyfill
in the tests as in the app exposed a test which tried
to call a missing stub (flash.error).

The error previously went unnoticed because it was reported
via an unhandled Promise rejection. The core-js Promise polyfill
however has a last-resort handler for uncaught promises so
the error showed up.

 * Modify Dockerfile to use Gulp build command to
   build client assets.

 * Add 'git' dependency required for installation of
   node-sass npm dependency.

Using an external reference to h.woff rather than an inline font
enables the font to load when served by the Chrome extension
on sites that have a strict Content Security Policy, such as
GitHub.

Regarding the removed comment about URL rewriting, the
new Gulp-based build system currently doesn't do any
URL rewriting but we do know that styles
will be served at /(assets|public)/styles/<bundle name>.css
and fonts at /(assets|public)/fonts/<name>.woff , so
we can just use a URL relative to the CSS file path.

Fixes #2266

After replacing the asset build pipeline with Gulp, webassets'
only function was to generate URLs for files defined in
named bundles and add cache-busting query strings.

It wasn't doing the latter because webassets does not
generate cache-busting query strings for files it serves
unless at least one filter is used or an output path is defined.

This commit replaces webassets with a Pyramid static view
and a small custom asset config environment, h.assets.Environment.

h.assets.Environment reads a set of named bundles defined
in the h/assets.yaml config file and a JSON manifest which maps
file paths to URLs with cache-busting query strings, generated
by the Gulp build process.

In the process, the logic for adding CORS headers to static
asset requests has been rewritten to 1) Explain _why_
a CORS header is needed and 2) Add the headers in a way
that doesn't rely on internal details of how Pyramid works.

pyramid.static.static_view is used directly rather than
config.add_static_view() because add_static_view() does
not provide a way to decorate requests in order to add
the CORS header.

See https://github.com/Pylons/pyramid/issues/1486

The URL polyfill is only required if window.URL lacks
a constructor.

'js-polyfills/url' does have its own feature detection but
relies on 'URL' being available at 'this.URL' which works
when loaded independently but not when included as a CommonJS
dependency.

Adding our own feature test here should make it easier to
avoid loading the polyfill entirely in future on browsers
that support the URL constructor.

Piping CSS files through autoprefixer
is now handled in gulpfile.js

As per the comment in karma-phantom-polyfills.js, it is
preferable that the tests use only a minimal set
of polyfills which match those used in the app.

Since we now have a script which requires all of the polyfills
used in the app for IE 10/11, we can just include that
in karma-phantomjs-polyfill.js.

This also removes the need to keep two separate Promise polyfill
packages.

 * Explicitly require the polyfills bundle from the sidebar
   and injector. In future we'll want to avoid including these
   polyfills for newer browsers but requiring it explicitly
   makes it obvious if the bundle is missing in the meantime.

 * Simplify the configuration specifying the modules to
   skip parsing for, since there are only two.

 * Reduce duplicated logic for creating app bundle configuration

 * Add additional comments and documentation to explain
   what various parts of the config do

 * Rename createBundle.js -> create-bundle.js for consistency with
   the rest of the codebase and move vendor-bundles.js to
   scripts/gulp to avoid cluttering the top of the source tree.

 * Unset the doNotParse flag on Bootstrap, since the npm package
   _does_ use CommonJS modules.

ES2015 polyfills have now been centralized in the polyfills.js
script.

By default the app bundle included the large polyfills
for Node's buffer and crypto modules due to them being
required by node-uuid.

Fix this by making Buffer undefined in the browser
and explicitly whitelisting the set of modules
that Browserify should polyfill.

In particular, explain why noParse is useful and may even be
required.

As explained at https://developer.mozilla.org/en-US/docs/Web/CSS/linear-gradient#History_of_the_syntax
the direction syntax was changed a long time ago from '<starting point>'
to 'to <destination point>'.

This fixes a warning from autoprefixer.

This removes several dependencies from the tests that
were unused and fixes an issue where Angular was loaded
multiple times, once as a global script and once on the
first use of "require('angular')" inside a module included
in the tests.

Use the correct import format for global imports
of ES2015 polyfills, as per the core-js documentation.

This replaces the webassets build for the front-end JavaScript
and CSS with Gulp + Browserify. webassets continues to be used but
only to serve the assets, not to generate them or keep
track of dependencies.

 * Use CommonJS for all JS dependency imports rather than relying
   on Window globals. This makes dependencies more explicit
   and avoids the need to specify dependencies explicitly
   in the build tool, since they can be statically analyzed
   via the require graph.

 * Remove the webassets custom filters for Browserify and
   CleanCSS.

 * Put all generated JS/CSS/font/image assets in
   build/{images,fonts,styles,scripts}

 * Replace compass with node-sass + compass-mixins for building
   the SCSS files. We were not relying heavily on compass
   functions, many of them were used only for vendor prefixing
   which is now handled by autoprefixer, so we can remove the
   Ruby/compass dependency and substitute node-sass quite easily.

Add a first pass at a releaser script

Decouple transaction manager from database session

Fix annotation tag links

The ng-href directive does not treat its contents as
an Angular expression.

Fixes a regression introduced in e334fea0241282

Randomize websocket reconnects

Currently, if the websocket connection fails, then we will always
immediately attempt a reconnect. This can easily contribute to a
thundering herd problem if all WebSocket clients (or even a large
portion of them) are disconnected simultaneously.

This commit ensures that an aborted connection always results in at
least a 1s-2s (randomized) delay.