Security and patch rollup for FPR16 from ESR60/68

[classilla]

Through 83976e91b33c240da4297e8b05199f5004bdf879

Not relevant:
M1561695 (no GMP, no plugins, no Widevine)
M1533522 (no WebGL)
M1563133 (Android)
M1566523 (no GMP)
M1563994 (screw 10.15 and dropping 32-bit support)
M1566700 (and screw Intel macOS in general)

Candidates:
M1564330 (using our earlier ICU tzdata)
M1560495 https://hg.mozilla.org/releases/mozilla-esr60/rev/eb302e1e879a9ac002bdb95acabc1ff3d899f2c0 to dom/base/nsPerformance.h dom/base/nsPerformance.cpp dom/base/nsDOMNavigationTiming.cpp but check http://w3c-test.org/navigation-timing/unload-event-same-origin-check.html
M1564449 https://hg.mozilla.org/releases/mozilla-esr60/rev/23d04c883edb
M1562033 https://hg.mozilla.org/releases/mozilla-esr60/rev/3e5da344d87de189fb192032d3fecc23a6d58933 and https://hg.mozilla.org/releases/mozilla-esr60/rev/ca88b9fad7d5ee879e81dc2c8347b913718faa8e putative test case in bleh as tifoo
M1559715 https://hg.mozilla.org/releases/mozilla-esr60/rev/656ab502f280c80d473daa224c1ae014b15a4044
M1573160 https://hg.mozilla.org/releases/mozilla-esr60/rev/38189f281389