Replace `javascript:void(0)` with `#`

Fixes:
- issues with content security policy (#1215)
- onbeforeunload in IE (#403)

We don't need to add a preventDefault because all clicks on
.chzn-container already have a preventDefault
No href at all!
Merge remote-tracking branch 'upstream/no-more-js-void' into remove-attr