Regenerate our sauce access key

Because, silly me, obviously if we submit job status via cURL the
command will be visible in the build log, revealing our access key.
Updated to Annotator 74bf6fe4 (typed-packaging branch)
Follow Annotator changes
symmetry between test.ini and development.ini
Mistakenly commented es compatibility [test.ini]
Build assets before functional tests

This should reduce the need for lengthening timeouts in tests.
More test.ini and development.ini tidying
Tests run once, don't reload templates
Remove unused .ini directives and clean up deps

With this change, setup.py should be sufficient to get h running with the
sole exception of pyramid_webassets, which has a release coming soon.

I only pinned to exact versions where I think there's a reasonable chance
of an upgrade breaking something soon, or where there are known issues. For
instance, d3.js has unicode characters that break webassets 0.9.

I really think there should be some best practice here that I'm missing, but
for now I've tried to just use >= wherever possible and == when necessary.