Die if we have a realpath file vs doc root mismatch

Stops LFI attacks such as:

lib/file-control.php?action=load&file=/..././/..././/..././/..././/..././/..././etc|passwd&csrf=4c43835566ee4e2x4a455df75a66c47f
Cover local and remote files, but avoid LFI
Stop if running old version

Shouldn't do this and could be a security vuln.
Chaneg path scope & check excludedArray first

treePaths, diffPaths and deletedPaths now all namespaced to top level so
we can access from elsewhere
Check we have excludedArray first before looking at it's index. This is
to avoid issues when switching in and out of GitHub Diff mode.
Load screen, path removal, tweaks & error handling

Show loading screen on clicking Commit button
Committed filepaths need to have pipes replaced with slashes
Splice from diffPaths or deletedPaths array so we remove committed files
Hide Loading mask if we don't have more to commit
Only display alert message and toggle GitHub diff mode if we have no
diff or deleted paths left to deal with
Error message is an object, so inform user that we'll console.log that.
Path fixes for add and delete actions

When adding files, location should be a slash if not set
Remove any initial double slashes
When removing files, location should be blank if not set. Then replace
iceRoot with a slash, before reducing double slashes at start, slashes
for pipes and tack together with file to make the targetElem, which is
what we end up looking for
Update to match main JS file
realpath $fileName, die if !exist or !$docRoot
realpath the file and die if !exist or !$docRoot
realpath file, result in error if !exist / !docroot
die() so we go no further

Clients can ignore this and continue. All headers should be followed up
by a die().
Warn if using over non https connection
Merge pull request #455 from xoofoo-project/master

Update french language
Display ICEcoder at a 1.0 scale

Displays without scaling on tablets and phones then. Not that it's
tablet friendly, but maybe one day.
Add section for pulls, display message re v4.3
Font family needed for textarea
base64.js not needed

Only needed for basic auth and we are using oauth tokens
Need to establish full $file path first

Otherwise we won't have a valid fullpath to find $docRoot in
Establish realpath test begins with $docRoot or die

No need to str_replace ../, as that isn't real protection, use realpath
instead
Always turn into a real path (we'll only pass relative paths here
anyway), and change \ to / on Windows setups
Only if file exists and begins with the root path do anything, die
otherwise
Make all paths abs and check realpath on each