Never add two sourceMappingURL notes to a file

(eg, when roundtripping through JsImage.readFromDisk)

Pre-0.9.0 this just means excessive rebuilds; on the packaging branch,
this means excessive version number bumps!
Remove sentence about SRP from docs
jobs note
note that dev bundle 0.3.39 will shortly be in use
copy-dev-bundle-from-jenkins: don't overwrite!
more dev bundle warnings
Move reload safety belt into an opt-in package
galaxy-reload-safetybelt -> reload-safetybelt
Make more generic `additionalStaticJs` interface in webapp.

Now webapp doesn't need to know anything about the reload safetybelt; it
just exposes a generic interface that any package can use to include
additional static JS (inlined when possible) in the boilerplate
HTML. reload-safetybelt uses this interface, instead of webapp
weak-depending on reload-safetybelt.
Remove reload safetybelt selftest.

It's been replaced by package tests (webapp, reload-safetybelt).
New approach for reload safety belt testing.

Mutating global state in tests is still not a good idea. (Specifically,
in the previous version of the test, changing the value of
`WebAppInternals.inlineScriptsAllowed()` could mess with other
client-side tests that depend on it being one way or another -- of which
there are currently probably none, but there could be in theory.)

Instead, export the exact things we want to test (boilerplate HTML
generation and the static file handler). Now we are still mutating the
global `inlineScriptsAllowed()` state, but we don't yield before setting
it back to what it was.

Also simplify the reload-safetybelt test: instead of sending an HTTP
request, just check that the script gets adding to
`WebAppInternals.additionalStaticJs`.
Wrap webapp test code in _noYieldsAllowed.
Rename serveStaticFiles to staticFilesMiddleware
Merge branch 'reload-safetybelt-package' into devel
Restore optionality of loginWithPassword/changePassword callbacks.

Fixes a regression in 0.8.2.

Fixes #2255.
Update BUNDLE_VERSION note in meteor script
Observe-sequence package recognizes different cursors by checking the interface
of observe and fetch.

Before it checked that the cursor is an instance of Minimongo.Cursor.
Revert change to warning text, going to do this on Monday
install script should write files as current user

If you ran it as root before, it would write files as whatever uid we
had on our buildbot. Oops!

Fixes #2249.
Clarify that your publisher must do SOMETHING

Either return cursor(s), or use the low-level API.

Fixes #2253