docs(guide/$location): fix a typo

Change "window.location.path" to "window.location.pathname".

Closes #8012
style(Angular.js): remove extra whitespace
fix($http): should not read statusText on IE<10 when request is aborted

Commit 1d2414c introduced a regression by retrieving the statusText
of an aborted xhr request. This breaks IE9, which throws a c00c023f
error when accessing properties of an aborted xhr request. The fix
is similar to the one in commit 6f1050d.
fix($parse): forbid referencing Object in angular expressions

It was possible to run arbitrary JS from inside angular expressions using the
`Object.getOwnPropertyDescriptor` method like this since commit 4ab16aaa:
    ''.sub.call.call(
      ({})["constructor"].getOwnPropertyDescriptor(''.sub.__proto__, "constructor").value,
      null,
      "alert(1)"
    )()
Fix that by blocking access to `Object` because `Object` isn't accessible
without tricks anyway and it provides some other nasty functions.

BREAKING CHANGE:
This prevents the use of `Object` inside angular expressions.
If you need Object.keys, make it accessible in the scope.
fix($parse): forbid __{define,lookup}{Getter,Setter}__ properties

It was possible to use `{}.__defineGetter__.call(null, 'alert', (0).valueOf.bind(0))` to set
`window.alert` to a false-ish value, thereby breaking the `isWindow` check, which might lead
to arbitrary code execution in browsers that let you obtain the window object using Array methods.
Prevent that by blacklisting the nasty __{define,lookup}{Getter,Setter}__ properties.

BREAKING CHANGE:
This prevents the use of __{define,lookup}{Getter,Setter}__ inside angular
expressions. If you really need them for some reason, please wrap/bind them to make them
less dangerous, then make them available through the scope object.
fix($parse): forbid __proto__ properties in angular expressions

__proto__ can be used to mess with global prototypes and it's
deprecated. Therefore, blacklisting it seems like a good idea.

BREAKING CHANGE:
The (deprecated) __proto__ propery does not work inside angular expressions
anymore.
refactor($parse): move around previous security changes made to $parse
fix($parse): prevent invocation of Function's bind, call and apply

BREAKING CHANGE:
You can no longer invoke .bind, .call or .apply on a function in angular expressions.
This is to disallow changing the behaviour of existing functions
in an unforseen fashion.
style(parseSpec): make jshint happy
fix($parse): make the window check in ensureSafeObject IE8 friendly
fix($parse): don't check Function.prototype.bind when it doesn't exist

e.g. IE8 doesn't have it
test($parse): skip Function.prototype.bind test on IE8
fix(testabilityPatch): fix invocations of angular.mock.dump
docs(CHANGELOG.md): add changes for 1.3.0-beta.14 and 1.2.19
fix($http): don't remove content-type header if data is set by request transform

Fixes #7910
docs($parse): add missing 'isecobj' error page
fix($location): remove query args when passed in object

Query args will be removed from $location search object if they are passed in as null or undefined object properties

Closes #6565
docs($location): update $location.search() jsdoc signature

Closes #8050
chore(watchr-docs): remove watchr-docs.rb

This file hasn't changed in forever, and doesn't seem to be in use any longer.

Closes #7978
docs($sce): fix code samples and example

The code samples were using `<pre>` tags rather than code fences (```) so they were
not being displayed correctly.

The inline code example (defined by a `<example>` element) had been placed in an
`@example` jsdoc tag, so rather than appearing inline at the declaration point in
the text, they were being appended to the end of the document in the `Example` section.

Closes #8053