support dynamic choice lists in configurable reports


![image](https://cloud.githubusercontent.com/assets/66555/4958688/43116552-66b1-11e4-9e97-68874196e7e1.png)

includes the following changes:

- way for filters to dynamically specify javascript in addition to html templates: https://github.com/dimagi/commcare-hq/pull/4726/files#diff-2a771ce4941a4a8f2ebd1f7bf2a8dc77R74
- dynamic choice list filter base class for handling configurable ajax url endpoint, templates, and parameterization https://github.com/dimagi/commcare-hq/pull/4726/files#diff-e4b58799e85ecb0445e2ab040416a01eR156 (and the referenced html/js file)
- lightweight way of dynamically getting the url out via template tag https://github.com/dimagi/commcare-hq/pull/4726/files#diff-e19c7aecd0a6b7ff147f45c501321783R6
- plugging it all together for user configurable reports filters
 - instantiation https://github.com/dimagi/commcare-hq/pull/4726/files#diff-2289dca64bccf8fc007e2a45f4285cc7R33
 - api url https://github.com/dimagi/commcare-hq/pull/4726/files#diff-c9f21de2cab313e09b6e42d1e0312a09R158

sorry it's in one giant commit. i was touching a lot of things in parallel and never got fully happy with it until i was done.
"defined on a model but the model" - does that mean it's a Python identifier? If yes, then I think we're safe.

If not, then... since this is querying a column, then presumably a table was created having a column with the same name? In that case the injection could have already happened (although it could have been quoted), maybe? Checking against a list of valid names (i.e., the list of column names for the table being queried) might be easiest.