fix($parse): forbid __{define,lookup}{Getter,Setter}__ properties

It was possible to use `{}.__defineGetter__.call(null, 'alert', (0).valueOf.bind(0))` to set
`window.alert` to a false-ish value, thereby breaking the `isWindow` check, which might lead
to arbitrary code execution in browsers that let you obtain the window object using Array methods.
Prevent that by blacklisting the nasty __{define,lookup}{Getter,Setter}__ properties.

BREAKING CHANGE:
This prevents the use of __{define,lookup}{Getter,Setter}__ inside angular
expressions. If you really need them for some reason, please wrap/bind them to make them
less dangerous, then make them available through the scope object.
fix($parse): forbid __proto__ properties in angular expressions

__proto__ can be used to mess with global prototypes and it's
deprecated. Therefore, blacklisting it seems like a good idea.

BREAKING CHANGE:
The (deprecated) __proto__ propery does not work inside angular expressions
anymore.
refactor($parse): move around previous security changes made to $parse
fix($parse): prevent invocation of Function's bind, call and apply

BREAKING CHANGE:
You can no longer invoke .bind, .call or .apply on a function in angular expressions.
This is to disallow changing the behaviour of existing functions
in an unforseen fashion.
style(parseSpec): make jshint happy
fix($http): don't remove content-type header if data is set by request transform

Fixes #7910
docs(CHANGELOG.md): add changes for 1.3.0-beta.14 and 1.2.19
fix($location): remove query args when passed in object

Query args will be removed from $location search object if they are passed in as null or undefined object properties

Closes #6565
feat(ngAnimate): conditionally allow child animations to run in parallel with parent animations

By default ngAnimate prevents child animations from running when a parent is performing an animation.
However there are a cases when an application should allow all child animations to run without blocking
each other. By placing the `ng-animate-children` flag in the template, this effect can now be put to
use within the template.

Closes #7946
feat($animate): allow directives to cancel animation events

Closes #7722
fix($animate): remove the ng-animate className after canceling animation

Closes #7784
Closes #7801
Closes #7894
docs(guide): fixes to ngShow/ngHide animations
feat(FormController): add `$rollbackViewValue` to rollback all controls

Currently it is possible to use `ngModelOptions` to pend model updates until form is submitted, but in case the user wants to reset the form back to its original values he must call `$rollbackViewValue` on each input control in the form. This commit adds a `$rollbackViewValue` on the form controller in order to make this operation easier, similarly to `$commitViewValue`.

Closes #7595
perf($compile): no longer need nodeType filter when setting $scope data

Closes #7887
fix($animate): ensure that parallel class-based animations are all eventually closed

When multiple classes are added/removed in parallel then $animate only closes off the
last animation when the fallback timer has expired. Now all animations are closed off.

Fixes #7766
docs($location): update $location.search() jsdoc signature

Closes #8050
chore(watchr-docs): remove watchr-docs.rb

This file hasn't changed in forever, and doesn't seem to be in use any longer.

Closes #7978
feat(input): support constant expressions for ngTrueValue/ngFalseValue

ngTrueValue and ngFalseValue now support parsed expressions which the parser determines to be constant values.

BREAKING CHANGE:

Previously, these attributes would always be treated as strings. However, they are now parsed as
expressions, and will throw if an expression is non-constant.

To convert non-constant strings into constant expressions, simply wrap them in an extra pair of quotes, like so:

    <input type="checkbox" ng-model="..." ng-true-value="'truthyValue'">

Closes #8041
Closes #5346
Closes #1199
chore(e2e): update protractor to 1.0.0-rc2 and add more logging

Use the new options from the reporter to add more logging to end to end tests,
and increase the Jasmine test timeout from 30 seconds to 60 seconds to allow for
legitimately long-lasting tests.
docs($sce): fix code samples and example

The code samples were using `<pre>` tags rather than code fences (```) so they were
not being displayed correctly.

The inline code example (defined by a `<example>` element) had been placed in an
`@example` jsdoc tag, so rather than appearing inline at the declaration point in
the text, they were being appended to the end of the document in the `Example` section.

Closes #8053