Allow a timeout to be optionally specified

[m-cMerge](http://www.graememcc.co.uk/m-cmerge) uses bz.js to handle BzAPI requests. When https://bugzilla.mozilla.org has issues (such as the data centre issues yesterday) it would be nice to fail gracefully instead of waiting for a callback that will never come!

Points to note:
 * The default timeout is 0 (no timeout) to mimic current behaviour
 * For node, I now explicitly construct the parameters for **request**, and separately add the  timeout if non-zero. Reading the code for **request**, it appears a timeout of zero is ignored, and could be safely passed in, but this behaviour is not explicitly documented, so I don't want to rely on it.
 * Ontimeout is fired after readystatechange, which meant checking for a null status in onreadystatechange. This in turn required an onerror handler to ensure handleResponse still gets called in other null status cases. I ignored abort, as there's no way for the caller to trigger an abort, and no code within bz.js would trigger it.
 * In browser, I used the same strings ("error", "timeout") that jQuery Ajax would return out of selfish convenience!
 * However, I didn't want to throw away potentially useful error text in node. This meant I couldn't ensure the same error text in both browser and node, and thus prevented the writing of a test for the error case.