Disable the developer hash parameters by default in PRODUCTION builds of PDF.js

This PR adds a `pdfBugEnabled` preference, which in `PRODUCTION` builds must be set in order to enable the developer hash parameters.

Fixes #4954.

*Note:* To simplify development/debugging, I purposely left the hash parameters enabled by default when the viewer is used in non-production mode, e.g. with `node make server`.