Bug #6253: Add canvas image extraction prompt.

(See also Bug #12684, Make "Not now" default for HTML5 canvas permission dialogue,
patched by Isis Lovecruft.)

This implements a `PopupNotification` [0] which notifies users that a
website has attempted to access an HTML5 canvas. The default
ordering for buttons is:

    Not Now
    Never for this site (recommended)
    Allow in the future

 * FIXES #12684 [1] by making "Not Now" the default in the HTML5 canvas
   fingerprinting permissions dialogue.

 * Palette icons included in HTML5 canvas permissions PopupNotification UI.
   The image is freely licensed and obtainable from:
   https://openclipart.org/image/300px/svg_to_png/21620/ben_palette.png

 * Includes a CSS whitespace hack from Pearl Crescent to the
   `CanvasPermissionPromptHelper_init()` function in
   `browser/base/content/browser.js` for causing the newlines in the
   `canvas.siteprompt` string (in torbutton.git, in
   `chrome/locale/en/torbutton.properties`) to render correctly in
   PopupNotification XUL <description> elements. [2]

NOTE: Applying this patch requires an additional patch to TorButton, to
store the additional UI strings before localisation. [3]

[0]: https://mxr.mozilla.org/mozilla-esr24/source/toolkit/modules/PopupNotifications.jsm
[1]: https://bugs.torproject.org/12684
[2]: https://trac.torproject.org/projects/tor/ticket/12684#comment:21
[3]: https://github.com/isislovecruft/torbutton/commit/368e74d62df349b27cf578525c3fa15da19ccdc2
Bug #5856: Do not expose physical screen info via window & window.screen.
Bug #6786: Do not expose system colors to CSS or canvas.

This patch also contains a hack to use properly contrasting colors if the
desktop theme specifies white on black for text colors (see
https://trac.torproject.org/projects/tor/ticket/7920). These color choices are
also not exposed to content.
Bug #10819: Add a pref, "privacy.thirdparty.isolate", to allow the activation or deactivation of isolating DOM storage and image caching by first party URI.
Bug #6539: Isolate the Image Cache per url bar domain.

The image cache maintains its own table outside of the main cache, and does
not obey cacheKeys by default.
Bug #6564: Isolate DOM storage to first party URI.

Also prevent DOM storage from ever writing to disk.
Bug #5282: Randomize HTTP request order and pipeline depth.

This is an experimental defense against Website Traffic Fingerprinting:
http://lorre.uni.lu/~andriy/papers/acmccs-wpes11-fingerprinting.pdf

See:
https://blog.torproject.org/blog/experimental-defense-website-traffic-fingerprinting

This patch is different from the approach described in that post, as well as
the 10.x ESR patch, as the pipelining code has changed significantly between
the time of writing of that post and Firefox 17.

The main control nob for this patch is now the about:config pref
"network.http.pipelining.max-optimistic-requests". The value of that pref
represents the minimum number of pipelined requests we will attempt to batch
together.

The total outstanding pipeline size is randomized between that value and
"network.http.pipelining.maxrequests" on a per-host basis.

Care must be taken when evaluating this defense, as pipeline behavior is
extremely sensitive to browser performance. In fact, a debug build alone is
enough to significantly impair request availability to the pipeline (due
slower document parsing and rendering). For this reason, we provide two
separate debug log defines. For most evaluation circumstances, you want to
define only WTF_TEST in an optimized build to only log request order,
combination behavior, and cases where the pipeline is forcibly disabled.

This patch may also have some minor impact on SPDY request order, but the SPDY
implementation has not been altered directly. It has several stream queues
that may also benefit from reordering and batching, as well as a more compact
request representation that will allow more requests to be packed inside Tor
cells. If you have interest in evaluating SPDY in a study of Website Traffic
Fingerprinting, please contact me.
Bug #10159: Build determinism fixes

Enforce sorted ordering on build and link lists. Also omit hostname from
buildinfo.
Bug #9837: Disable uninstall helper.exe on Win32.

Fixes 'make package' breakage on Windows builds.
Bug #10139: Make --enable-strip work again

Patch analogous to https://bugzilla.mozilla.org/show_bug.cgi?id=841373
Bug #9829.1: new .mozconfig file for the new cross-compiler and ESR24
Bug #9829.4: Ray's otool patch
Bug #10252: backout of Mozilla's #872649 as this breaks TBB on Windows
Bug #9173: Change the default Firefox profile directory to be TBB-relative.

This should eliminate our need to rely on a wrapper script that sets $HOME and
launches Firefox with -profile.
Bug #11641: change TBB directory structure to be more like Firefox's

Unless the -osint command line flag is used, the browser now defaults
to the equivalent of -no-remote.  There is a new -allow-remote flag that
may be used to restore the original (Firefox-like) default behavior.
Bug #12146: Make the CONNECT Host header the same as the Request-URI.

It's possible to construct a request where the Host header differs from
the authority in the URL, for example in an extension with
nsIHttpChannel and setRequestHeader. MakeConnectString generates a
host:port string for the CONNECT Request-Line, but peeks into the
tunneled request in order to copy the Host header to the proxy request.

Instead, use the same host:port string for Host as is used in the
Request-URI, to avoid revealing the plaintext of the Host header outside
of the tunnel.

Backport of https://hg.mozilla.org/mozilla-central/rev/a1f6458800d4.
Bug #9701: Prevent ClipBoardCache from writing to disk.

This disables the disk activity entirely. It seems as though there is no
reason in to write backup copies of clipboard data to disk, as the clipboard
code does not release the related memory upon disk writes anyway.

See https://trac.torproject.org/projects/tor/ticket/9701.
TB5: Disable SSL Session ID tracking.

We can't easily bind SSL Session ID tracking to url bar domain,
so we have to disable them to satisfy
https://www.torproject.org/projects/torbrowser/design/#identifier-linkability.
Bug #10895: Fix language pack usage (fix Firefox version).