Rather than having some CSS lingering in directories like the static
base (icomoon) or vendored scripts (toastr, katex), create a dedicated
place for these under h/static/styles/vendor.

Icomoon and Katex fit together nicely, combining the font folders.

This commit also sees the re-introduction of the cssrewrite filter
to ensure that the relative URLs are properly rebased.

Hack around lack of messageThread prototype

Fix #2182

[WIP] Re-add "scroll to new annotation" feature

This reverts commit ba68d710b84d2a78426fd6c0ed325e8c40cbbca1.

Logically, it makes sense to prevent double _embedding_ in the embed
code.

Also, there may come a time when it's acceptable and possible to
instantiate the application multiple times for different parts of a
document.

Finally, this prevents loading CSS and polyfills twice, as well.

This should speed up the stream and ensure that results coming back
from the server are not filtered out due to a mismatch between the
page search and elasticsearch query treatment.

Close #2175

This change also means that the application actually starts after
the `noConflict` calls have erased any trace of Annotator or jQuery
from the global object.

AnnotationSync was using $.extend. Since I don't want to depend on
jQuery in the widget application indefinitely and I don't want to
depend on Annotator either there is not a single place to get this
function that works in both environments. Instead, a single purpose
module from NPM for extend is pulled in. Small modules FTW.

Add a blocklist of sites we don't launch on

Center icons in toolbar buttons.

Get Promise explicitly through requires

The blocklist is configured in production.ini like so:

    h.blocklist = {
        "seanh.cc": {},
        "finance.yahoo.com": {},
        "twitter.com": {}
    }

The Chrome extension handles the blocklist in the same way that it
handles other launch errors (e.g. when the user hasn't given the
extension permission to annotate file:/// URLs): it adds a (!) error
badge to the "browser action" button, if the button is clicked again it
opens a "help" page saying that the site isn't supported yet.

It doesn't seem to be possible to pass data into the Chrome extension's
help pages (as far as I can tell) so the error is just "Hypothesis
doesn't work on this page yet" and not e.g. "Hypothesis doesn't work on
twitter.com".

The bookmarklet handles the blocklist in the same way that it handles
other launch errors (e.g. trying to annotate a PDF when PDF.js isn't
available): it uses window.alert() to show an error.

This eliminates a lot of polyfill cruft. Also, we had two different
promise polyfills in the vendor directory (O.o).

Close #2164

This reverts commit 04504dca0b36cffd57d3fd7fe071fd1ef52079b0.

Re-add protection against double deployment

Rework sidebar drag resize

Fix IE problems

Now using Hammerjs.

- Swipe or drag the toggle to open/close.

- The sidebar is clamped to not ever be pushed beyond the right
  edge of the screen.

Fix #305

Oops! That was a mistake. If we disable pointer events on the
ancestor, we need to re-enable them below.

Add docs for serving ssl in development

Show spinner in search bar during requests

This is unnecessary and less obvious than the toggle button, which
means it's not worth the egregious fail of preventing interaction
with scrollbars, etc.

This has been deemed too clever.