Viewer: Remove inline events; set height on error

Move inline event handlers to viewer.js to comply with a
Content-Security-Policy where directive "unsafe-inline" is not set.

Change textarea.rows = <number of newlines> to
textarea.style.height = textarea.scrollHeight.
(The former is extremely unreliable; consider long lines...)
Merge pull request #3486 from Rob--W/csp-unsafe-inline

Remove all inline JavaScript from viewer.html to comply with CSP unsafe-inline and correct error textarea's height