Replace `javascript:void(0)` with `#`

Fixes:
- issues with content security policy (#1215)
- onbeforeunload in IE (#403)

We don't need to add a preventDefault because all clicks on
.chzn-container already have a preventDefault
No href at all!
remove use of attr(), closes #334
remove href of <a />
use native dom element
enforce pointer cursor for links
Merge remote-tracking branch 'upstream/no-more-js-void' into remove-attr
Merge pull request #1385 from koenpunt/remove-attr

Remove javascript:void and attr references