Use a URL fragment rather than query string to pass configuration from
the host page to the sidebar app.

Only the client, not h, needs access to this configuration, but passing
it in a query string causes this information to act as a cache-buster
for what should be a highly-cacheable resource
(https://hypothes.is/app.html). The long query string also ends up
polluting reports in tools like Google Analytics and h access logs.

The content and format of the config string remains the same, only the
delivery method has changed.

Relevant context: https://hypothes-is.slack.com/archives/C4K6M7P5E/p1575447372326000