Fix double loading on install

This issue arises because we're not checking the status of the tab
before trying to inject. So when during installation a new tab is
created and the extension activated this triggers the change from
'inactive' -> 'active' in TabState which embeds the sidebar into the
loading tab. Later the update function is called when the tab loading is
complete injecting the sidebar a second time.

We now explicitly check the tab status in the injection handler to
prevent injection into a loading tab.

Fixes #1756.
Rename Heatmap -> BucketBar

Ref #1236
Merge pull request #1767 from hypothesis/rename-heatmap

Rename Heatmap -> BucketBar.
Remove unused dynamic bucket code
Merge pull request #1768 from hypothesis/remove-dynamic-bucket

Remove dynamic bucket from BucketBar
Move thread conditionals onto top level element

Rather than the thread-reply and thread-load-more elements having
one set of conditions on the parent and one on the child we now ensure
that the entire element is always shown/hidden.
Merge pull request #1758 from hypothesis/1756-double-load-on-install

Fix double loading on install
Merge pull request #1770 from hypothesis/thread-display

Move thread ng-show conditionals onto parent elements
Include h automatically when creating the app
Update api.rst
Update api.rst
Update PDF plugin

... to 18d8f72a (typed-packaging branch),
which brings support for the PDF.js version
shiping with FF35.
Updated content security policy.

Modified the content security policy to allow getting MathJax resources from cdn.mathjax.org and downloading KaTex fonts for rendering math.
Merge pull request #1779 from hypothesis/update-CSP-chrome

Updated content security policy.
Merge pull request #1775 from hypothesis/update-pdfjs-support

Update PDF plugin
Try installing ICU plugin on Travis
Raise a error if the ICU plugin is not installed

This plugin is required by ElasticSearch and provides installation
instructions when required. This was causing issues for new contributors
who missed this part of the README.
Postpone the scanning

... to the point when the panel is already ready.

Hopefully, this makes the sidebar connect and appear sooner.

We can't delay in any further, because setting the
visible highlights (which happens in the next line)
will trigger a bucket bar (a.k.a. heatmap) refresh,
and the heatmap uses information produced by the scanning.
Merge pull request #1783 from hypothesis/delay-scanning

Postpone the scanning
Further clean out h/__init__.py

It's useful to put these app-level things, like the root factory,
favicon and status check routes, outside the package root so that
the package can be included into other applications without messing
with their setup.

It also means that if h includes some other package that sets a
different root factory, it gets overridden by the one provided here.