Realms

This adds realm support to Persona, specifically using the watch() api.

Realms allow a group of sites to state they are connected as part of a group, and if a user logs into 1 site of the group, or realm, the user should be logged into all the sites in realm.

This can be done by passing an extra parameter to watch():

    navigator.id.watch({
      realm: 'http://realm.123done.org'
    });

The second part of the puzzle is that the watched realm must publish a well-known file describing everyone that is part of the realm.

    GET http://realm.123done.org/.well-known/browserid-realm
    {
      realm: ['http://foo.123done.org', 'http://bar.123done.org']
    }

If the site's origin is found in the list of the realms found at the well-known file, then Persona will believe it is part of the realm. If a user had logged in to `foo.123done.org`, and then visited `bar.123done.org`, and that site also watches the same realm, the user will be automatically logged in upon page load.

fixes #2555

### Blockers to merging

- [ ] B2G testing with @jedp 
- [ ] QA? perhaps QA is involved once merged to dev?
- [ ] Plan for automated testing, how can we avoid regression?  Do we need a new (set) of RPs so we can confirm we don't regress on this feature?
- [ ] security testing with Yvan
- [ ] legal bug with @lloyd @seanmonstar and Jishnu
- [ ] identity-ops deploying new proxy https://github.com/mozilla/identity-ops/commit/e6e293149747a18278d79fe4d3b5fa24bbbd0e69