Bug #2874: Block Components.interfaces from content

This patch removes the ability of content script to access
Components.interfaces.*. Implemented by removing the Components.interfaces
shim introduced in Parts 4, 6, and 7 of the patch in
https://bugzilla.mozilla.org/show_bug.cgi?id=790732.

Components.interfaces is useful for fingerprinting the platform, OS, and
Firefox version.

It appears to have no other legitimate use. See also:
https://bugzilla.mozilla.org/show_bug.cgi?id=429070

Includes regression test.
Bug #2950: Make Permissions Manager memory-only

This patch exposes a pref 'permissions.memory_only' that properly isolates the
permissions manager to memory, which is responsible for all user specified
site permissions, as well as stored STS policy.

The pref does successfully clear the permissions manager memory if toggled. It
does not need to be set in prefs.js, and can be handled by Torbutton.
Bug #2949: Make Intermediate Cert Store memory-only.

This patch makes the intermediate SSL cert store exist in memory only.

The pref must be set before startup in prefs.js.
https://trac.torproject.org/projects/tor/ticket/2949
TB1: Add a string-based cacheKey.

Used for isolating cache according to same-origin policy.
Bug #3547: Block all plugins except flash.

We cannot use the @mozilla.org/extensions/blocklist;1 service, because we
actually want to stop plugins from ever entering the browser's process space
and/or executing code (for example, AV plugins that collect statistics/analyse
urls, magical toolbars that phone home or "help" the user, skype buttons that
ruin our day, and censorship filters). Hence we rolled our own.

See https://trac.torproject.org/projects/tor/ticket/3547#comment:6 for musings
on a better way. Until then, it is delta-darwinism for us.
Bug #3229: Make content pref service memory-only + clearable

This prevents random urls from being inserted into content-prefs.sqllite in
the profile directory as content prefs change (includes site-zoom and perhaps
other site prefs?).
TB2: Provide an observer event to close persistent connections

We need to prevent linkability across "New Identity", which includes closing
keep-alive connections.
Bug #2875: Limit device and system specific CSS Media Queries.

See also Bug #5856.
Bug #2872: Limit the number of fonts per document.

See also Bug #5798.

We create two prefs:
browser.display.max_font_count and browser.display.max_font_attempts.
max_font_count sets a limit on the number of fonts actually used in the
document, and max_font_attempts sets a limit on the total number of CSS
queries that a document is allowed to perform.

Once either limit is reached, the browser behaves as if
browser.display.use_document_fonts was set to 0 for subsequent font queries.

If a pref is not set or is negative, that limit does not apply.

The use of "User Fonts" (aka WebFonts, aka @font-face fonts) are exempt from
both of these limits. The patch also makes such fonts take precedence over
local fonts. This vastly improves typography on many sites that would
otherwise hit these limits.

This is done to address:
https://www.torproject.org/projects/torbrowser/design/#fingerprinting-linkability
Bug #2176: Rebrand Firefox to TorBrowser

See also Bugs #5194, #7187, #8115, #8219.

This patch does some basic renaming of Firefox to TorBrowser. The rest of the
branding is done by images and icons.
Bug #4902: Add DDG and StartPage to Omnibox.

You mean there are search engines that don't require captchas if you don't
have a cookie? Holy crap. Get those in there now.
Bug #5715: Make nsICacheService.EvictEntries synchronous

This fixes a race condition that allows cache-based EverCookies to persist for
a brief time (on the order of minutes?) after cache clearing/"New Identity".

https://trac.torproject.org/projects/tor/ticket/5715
Bug #5741: Prevent WebSocket DNS leak.

This is due to an improper implementation of the WebSocket spec by Mozilla.

"There MUST be no more than one connection in a CONNECTING state.  If multiple
connections to the same IP address are attempted simultaneously, the client
MUST serialize them so that there is no more than one connection at a time
running through the following steps.

If the client cannot determine the IP address of the remote host (for
example, because all communication is being done through a proxy server that
performs DNS queries itself), then the client MUST assume for the purposes of
this step that each host name refers to a distinct remote host,"

https://tools.ietf.org/html/rfc6455#page-15

They implmented the first paragraph, but not the second...

While we're at it, we also prevent the DNS service from being used to look up
anything other than IP addresses if socks_remote_dns is set to true, so this
bug can't turn up in other components or due to 3rd party addons.
Bug #4517: Emit observer event to filter the Drag+Drop url list

This patch creates an "on-modify-drag-list" observer that addons can listen
to. For us, it supports Torbutton code that filters out Drag+Drop mime types
that the OS Desktop sniffs and attempts to load without Tor.

Such proxy bypass behavior is immediate on Mac and Ubuntu: you don't even have
to release the object for it to get sniffed and cause the OS to load it
without Tor. In fact, accidentally clicking for too long on an image is enough
to cause proxy bypass on those systems.
Bug #5742: API allows you to get the url bar URI for a channel or nsIDocument.
Bug #4755: Return client window coordinates for mouse event screenX/Y (for dragend, 0,0 is returned).
Bug #8312: Remove "This plugin is disabled" barrier.

We do not want to encourage our users to enable plugins at this point.

The barrier also causes bad UX for HTML5 video fallback on YouTube.
Bug #3875: Use Optimistic Data SOCKS variant.

This patch alters Firefox's SOCKS handshake to preemptively send data before
it is actually connected. This allows us to save a round trip during
connection setup.

See:
https://gitweb.torproject.org/torspec.git/blob/HEAD:/proposals/181-optimistic-data-client.txt
TB3: Tor Browser's official .mozconfigs.
TB4: Tor Browser's Firefox preference overrides.

This hack directly includes our preference changes in omni.ja.