Security and patch rollup for FPR12 from ESR60

[classilla]

Through 248ca5c585f8
I'm skipping the clang and buildsystem bugs to avoid spam here.

Not taking:
M1513021 (Windows only)
M1497749 (Windows/IPC)
M1512450 (not in 45)
M1458003 (not in our font code)
M1404666 (not affected/not supported)
M1493743 (seems limited to 10.14)
M1516738 (x86)
M1511701 (APZ only)
M1517542 (unaffected)

Deferred:
M1374012. It isn't clear if this fixes anything that is reachable, and has a high regression risk. On the other hand we could probably just copy it out of ESR60, so it wouldn't be mechanically difficult to upgrade and could be backed out in one pass if needed.

Candidates:
M1510114 https://hg.mozilla.org/releases/mozilla-esr60/rev/d7a3568fa10c
M1502871 https://hg.mozilla.org/releases/mozilla-esr60/rev/5f30ae385560
M1494364 https://hg.mozilla.org/releases/mozilla-esr60/rev/b99a10ea2d0a

M1485864 or at least some portions (do as single separate commit)
https://hg.mozilla.org/projects/nss/rev/4b966fea84c8c271af7a4b30ec5fc5406344e430
https://hg.mozilla.org/projects/nss/rev/9d1be6a2e610fe0b82832b187def81d103b697d7
https://hg.mozilla.org/projects/nss/rev/f5ef342733116dda9998d90a5809c5ddfa9090e3

[classilla]

Through e93a8e6c81dc
Again, dropping the clang change bugs and other build system ones to avoid bulk.

Not taking M1482659 (Windows only)
Taking https://hg.mozilla.org/releases/mozilla-esr60/rev/c13c0781ad99 ; this is quite safe and useful.