fix(l10n): ensure that supported languages are a subset of the default supported languages
refactor(client): Prepare for multiple channels.

* Channels are now ephemeral, no more storing channels on Session.
* Create a BaseChannel which is the root of all other Channels.
* Extract the current OAuth redirect code into its own channel named RedirectChannel.

* Use the channel's `send` interface to determine whether it supports OAuth auto-verification.
* Upon OAuth completion, display a spinner on the available submit button.
* Upon OAuth completion, if no response is received from the channel within 10 seconds, display an error message.

* Mock in some OAuth server interactions to allow for more unit test coverage.
* Remove the @vladikoff's FxWebChannel for now to simplify review. I will add this in a separate PR.
Merge pull request #1435 from mozilla/validate-supported-langs-config

fix(l10n): ensure that supported languages are a subset of the default s...
Rip out the notion of "should_auto_complete_after_email_verification" and auto-completing. It's not actually needed anywhere except the IFRAME channel, which isn't even part of this PR. Thanks @vladikoff!
Merge pull request #1437 from mozilla/prepare-for-multiple-oauth-channels

Prepare for multiple channels
chore(tests): Set Functional test timeout to 30 seconds. Adds directDomains and skipSslDomains for the SauceLabs tunnel.
Merge pull request #1501 from vladikoff/directDomains

chore(tests): Set Functional test timeout to 30 seconds. Adds directDoma...
Add the iframe channel, use the iframe channel if iframed.

* Add a close button in the content.
* Start the shell of a CancelButtonView.
* allow /oauth/signin & /oauth/signup to be framed.
* The iframe channel does an ping with the parent window to determine origin, only whitelisted origins can be iframed.
* Non-whitelisted origins are sent to the `/illegal_iframe` endpoint.
* Start on an OAuth RP include.js with a callback based API.
* Add a check in env-test to determine whether the user is in an iframe.
* Hook up the close button if iframed.
* Add the GET /iframe_allowed endpoint, hook that up to the front end. This allows for the full check of whether an iframe is allowed for an origin.