fix($compile): get $$observe listeners array as own property

Prevent accidentally treating a builtin function from Object.prototype as the binding object, and thus
preventing the compiler from throwing when using attribute binding names which match a property of the
Object prototype.

Closes #9343
Closes #9345
docs($compile): add header to example
docs(guide/compiler): change span to block element in draggable example

The draggable example does not work as expected in Chrome (37.0.2062.124 m).
The span disappears when dragged beyond what appears to be a small area.
Changing the span to a block element (with a width of 65px) resolves this issue.
An alternative solution would be to change the span to a div.
docs($compile): fix a broken link
docs(readme): fix formatting
docs(guide/concepts): improve readability
chore(ngCsp): add e2e tests

Also changes `connect:devserver` and `connect:testserver` to conditionally serve files with csp headers when the path contains `.csp` somewhere.

Closes #9136
Closes #9059
docs(minerr/unpr): note that ctrls cant depend on other ctrls
docs(guide/forms): improve example

When explaining ng-model-options, there's no print of `user.data` to show
the difference between the default behaviour and updateOn: 'blur'
fix(compile): sanitize srcset attribute

Applies similar sanitization as is applie to img[src] to img[srcset],
while adapting to the different semantics and syntax of srcset.
perf(ngForm,ngModel): move initial addClass to the compile phase

Closes #8268
fix(ngView): use animation promises ensure that only one leave animation occurs at a time

the tracking depended on a local flag variable, which was susceptible to corruption due to
race conditions.

using promises ensures that the previousLeaveAnimation is nulled out only if it hasn't been
canceled yet.

Closes #9355
Closes #7606
Closes #9374
fix(input): correctly handle invalid model values for `input[date/time/…]`

Similar to `input[number]` Angular will throw if the model value
for a `input[date]` is not a `Date` object.
For `Invalid Date`s (dates whose `getTime()` is `NaN`) `input[date]`
will render an empty string.

Closes #8949
Closes #9375
fix(input): register builtin parsers/formatters before anyone else

Previously, builtin parsers/formatters for e.g. `input[date]`
or `input[number]` were added in the post linking phase to `ngModelController`,
which in most cases was after a custom formatter/parser was registered.

This commit registers builtin parsers/formatters already
in the pre linking phase. With that builtin
parsers run first, and builtin formatters run last.

Closes #9218
Closes #9358
chore(docs): show error 404 without partial failing

We can move the test back into the main describe as it no longer causes an
error message to be logged
docs(changelog.md): update changelog for 1.3.0-rc.4 and 1.2.26
chore(docs): rearrange docs app search elements so close button is not first tab index
docs(guide/accessibility): add sortOrder to get it in the right position in the guide
docs($compile): improve transclusion documentation

Closes #9352
feat($location): add support for state and title in pushState

Adds $location pushState & replaceState methods acting as proxies to history
pushState & replaceState methods. This allows using pushState to change state
and title as well as URL. Note that these methods are not compatible with
browsers not supporting the HTML5 History API, e.g. IE 9 or Android < 4.0.

Closes #9027