Assets: reverse `js_vendor` and `js_common`

In `js_vendor` we don't actually include libraries but shim them so we're
able to use them as modules, therefore this bundle needs to come after
`js_common`. This dependency/restriction will go away once we switch all
our client-side code to use webpack and CommonJS modules.
Cleanup: removed dead code
Stats: data load is not async anymore, no need for a callback
Cleanup: mark as safe in a single place