Security and patch rollup for FPR5 from ESR52

[classilla]

Currently just certs and pins.

[classilla]

Through 5f753161df25

Not vulnerable:
M1224396 (we don't build Skia)
M1418447 (ditto)
M1414945 (we have the old code already)
M1423086 (not in 45)

Not taking:
M1415582 (no GMP support)
M1417797 (ditto)
M1410134 (introduced by M1214071 and I'm not sure the original code actually is exploitable)
M1382358 (no WebGL)
M1412420 (we don't support 64-bit, performance impact)
M1408631 (non-trivial, lacks most of the backwork, doesn't seem to be a major crasher)
M1394654 (you must be f**king kidding)
M1261963 (we don't support WebExtensions)
M1428880 (our users have suffered enough)

Deferred:
M1408276 (this is hard to trigger at best, we don't seem to get into this situation and we likely need to look at other places where main thread clean up is needed)
(if implemented anyway though, also implement M1360334, M1382366)
M1409951 (test case does not reproduce, regression risks)
M1399520 (fragile code, difficult or impossible to trigger)
M1387427 (large patch)

Candidates:
M1413741 https://hg.mozilla.org/releases/mozilla-esr52/rev/4e00ce2897c4 (to dom/workers/XMLHttpRequest.cpp)
M1419363 https://hg.mozilla.org/releases/mozilla-esr52/rev/0712b6cbbdc8 (may need to include mozilla/WeakPtr.h) (separate patch due to regression risk)
M1414425 https://hg.mozilla.org/releases/mozilla-esr52/rev/5623e01e63a8
M1408990 https://hg.mozilla.org/releases/mozilla-esr52/rev/04e3b5c1f0b2
M1412145 https://hg.mozilla.org/releases/mozilla-esr52/rev/66cfc3c4047d (separate patch due to crash risk)
M1418922 https://hg.mozilla.org/releases/mozilla-esr52/rev/aa55d4cdaee5
M1414452 https://hg.mozilla.org/releases/mozilla-esr52/rev/079356ed5317 (but convert to nsAutoTArray)
M1418854 https://hg.mozilla.org/releases/mozilla-esr52/rev/93e4994a892c
M1422389 https://hg.mozilla.org/releases/mozilla-esr52/rev/f8a6e1864832 (couldn't hurt)
M1415598 https://hg.mozilla.org/releases/mozilla-esr52/rev/0cc1c9068714 (just the RegisterVisitedCallback part)
M1423159 https://hg.mozilla.org/releases/mozilla-esr52/rev/6b4d3c5d5e51 (may also affect single process)
M1411708 https://hg.mozilla.org/releases/mozilla-esr52/rev/34c968767eb7 (but leave true for FPR5, set to false for FPR6)
M1399400 https://hg.mozilla.org/releases/mozilla-esr52/rev/3236ffdf0ced
M1395508 https://hg.mozilla.org/releases/mozilla-esr52/rev/263165eacc54 (doesn't need second patch)
M1408017 https://hg.mozilla.org/releases/mozilla-esr52/rev/aa4b11615431
M1425000 https://hg.mozilla.org/releases/mozilla-esr52/rev/66761c5bfbe1
M1428589 https://hg.mozilla.org/releases/mozilla-esr52/rev/f7865afb1fe6
M1427870 (is actually #459)
M1425780 https://hg.mozilla.org/releases/mozilla-esr52/rev/5f753161df25 (can't hurt)

[classilla]

Currently deferring on https://hg.mozilla.org/releases/mozilla-esr52/rev/b95d654de120 until the bug is visible to me because I don't like the possible performance impact.

[classilla]

M1331209 (no asmjs)
M1408631 (doesn't seem affected)
M1385667 (irrelevant)
M1425612 https://hg.mozilla.org/releases/mozilla-esr52/rev/410da936a1e8
M1426783 https://hg.mozilla.org/releases/mozilla-esr52/rev/fe271a2b9503

defer M1416878 as above

[classilla]

Not taking M1416878; I don't think it's exploitable in our configuration.