Refactor auth API and allow multiple cookie stores - #2976

Resolves #2965
Fixes a crash when scratch-messaging fails to fetch ST messages backported; see #2977

Technical changes:

• Breaking: synchronous getters (except csrfToken and scratchLang) have been removed. This change will eliminate potential race condition due to fetching sessions asynchronously.
• This PR does not remove auth from globalState, since non-addon codes are currently using this. However, this is ignored in content script.
• This PR also does not enable incognito on Firefox; this requires another change to storage.
• Sessions will be fetched on every load, as well as after either CSRF token or session changes.
• Due to the quirks of Listenable, Auth is no longer a property of common/Addon.js#Addon. However, all subclasses implement this as either that Auth or content-script/Auth.js#Auth. (change reverted in 966c78c) Content script includes waiting for session to be fetched, as well as cookie-based reading of CSRF token.
• Scratch Addons now stores satemporarytoken cookie on Scratch website when the extension loads. This cookie is used only to fetch the default store ID, will expire either after 10 seconds or after the store ID is grabbed, whichever is sooner. We do not expect this change to have privacy impacts.
• Default store ID is used to check if a cookie change requires session reload on main extension context (popups and background == notifier).
• Account API is changed; message counts are no longer requested via background.
• l10njson is no longer populated at background.
• localState.ready and allReady no longer includes auth.