chore($httpBackend): preserve original non-zero http status code for file:// apps

Previously if an app was running from file:// origin we would always return either
http 200 or 404 depending on whether the response was present.

This changes the behavior so that we do this only if the protocol of the request
(not the origin) is file:// and only if the status code is 0.

Closes #4436
Closes #4587
Closes #4514
fix($sanitize): Use same whitelist mechanism as $compile does.

`$sanitize` now uses the same mechanism as `$compile` to validate uris.
By this, the validation in `$sanitize` is more general and can be
configured in the same way as the one in `$compile`.

Changes
- Creates the new private service `$$sanitizeUri`.
- Moves related specs from `compileSpec.js` into `sanitizeUriSpec.js`.
- Refactors the `linky` filter to be less dependent on `$sanitize`
  internal functions.

Fixes #3748.
chore(release): fix cdn version in package.json
refactor($location): move file://+win path fix to $location

The urlResolve method was fixed to automatically remove the
volume label from path names to fix issues with the file
protocol on windows where $location.path() was returning
paths where the first segment would be the volume name,
such as "/C:/mypath". See #4942 and #4928

However, the solution was specific to the $location non-
HTML5 mode, and was implemented at a lower level of
abstraction than it should have been. This refactor moves
the fix to inside of the LocationHashBangUrl $$parse method.

Closes #5041
feat($attrs): add $attrs.$attr to externs so that it isn't renamed

This fixes the issue that any usage of $attr is broken after js compilation.
docs(CHANGELOG): add v1.2.3 changes
chore(release): cut 1.2.3 unicorn-zapper release
chore(release): start 1.2.4 wormhole-baster iteration
docs(migration): add a note about "private" properties being reverted

Closes #5086
docs(guide/compiler): add fourth step on appending the compiled template to the DOM

Closes #5087
docs(guide/providers): fix typo

Closes #5102
docs(guide/di): use square bracket notation for $inject annotation

Closes #5104
docs($injector): use square bracket notation for $inject annotation

Closes #5104
docs($window): move use of $window to controller

Move use of `$window` from template to controller, because accessing `$window`
in expressions is now disallowed and doesn't work.

Closes #5110
docs(guide/concepts): fix incorrect module name in example

Closes #5116
docs(form): provide a list of Angular's built-in validation tokens

As requested by a top-rated Disqus comment: http://docs.angularjs.org/api/ng.directive:form.FormController#comment-655325797

Closes #5121
docs(tutorial/step-0): add target="_blank" to open app in new page

Closes #5145
docs(tutorial/step-12): fix typo

Closes #5148
docs($compile): fix missing space
docs(tutorial/step-10): fix typo

Closes #5171