Moved vendored js/css into public/vendor and documented sources (#1484) (#2241)

* Cleaning up public/ and documenting js/css libs.

This commit mostly addresses #1484 by moving vendor'ed plugins into a
vendor/ directory and documenting their upstream source and license in
vendor/librejs.html.

This also proves gitea is using only open source js/css libraries which
helps toward reaching #1524.

* Removing unused css file.

The version of this file in use is located at:
  vendor/plugins/highlight/github.css

* Cleaned up librejs.html and added javascript header

A SafeJS function was added to templates/helper.go to allow keeping
comments inside of javascript.

A javascript comment was added in the header of templates/base/head.tmpl
to mark all non-inline source as free.

The librejs.html file was updated to meet the current librejs spec. I
have now verified that the librejs plugin detects most of the scripts
included in gitea and suspect the non-free detections are the result of
a bug in the plugin. I believe this commit is enough to meet the C0.0
requirement of #1534.

* Updating SafeJS function per lint suggestion

* Added VERSIONS file, per request

public/vendor/plugins/codemirror/mode/brainfuck/brainfuck.js

@@ -0,0 +1,85 @@
+// CodeMirror, copyright (c) by Marijn Haverbeke and others
+// Distributed under an MIT license: http://codemirror.net/LICENSE
+
+// Brainfuck mode created by Michael Kaminsky https://github.com/mkaminsky11
+
+(function(mod) {
+  if (typeof exports == "object" && typeof module == "object")
+    mod(require("../../lib/codemirror"))
+  else if (typeof define == "function" && define.amd)
+    define(["../../lib/codemirror"], mod)
+  else
+    mod(CodeMirror)
+})(function(CodeMirror) {
+  "use strict"
+  var reserve = "><+-.,[]".split("");
+  /*
+  comments can be either:
+  placed behind lines
+
+        +++    this is a comment
+
+  where reserved characters cannot be used
+  or in a loop
+  [
+    this is ok to use [ ] and stuff
+  ]
+  or preceded by #
+  */
+  CodeMirror.defineMode("brainfuck", function() {
+    return {
+      startState: function() {
+        return {
+          commentLine: false,
+          left: 0,
+          right: 0,
+          commentLoop: false
+        }
+      },
+      token: function(stream, state) {
+        if (stream.eatSpace()) return null
+        if(stream.sol()){
+          state.commentLine = false;
+        }
+        var ch = stream.next().toString();
+        if(reserve.indexOf(ch) !== -1){
+          if(state.commentLine === true){
+            if(stream.eol()){
+              state.commentLine = false;
+            }
+            return "comment";
+          }
+          if(ch === "]" || ch === "["){
+            if(ch === "["){
+              state.left++;
+            }
+            else{
+              state.right++;
+            }
+            return "bracket";
+          }
+          else if(ch === "+" || ch === "-"){
+            return "keyword";
+          }
+          else if(ch === "<" || ch === ">"){
+            return "atom";
+          }
+          else if(ch === "." || ch === ","){
+            return "def";
+          }
+        }
+        else{
+          state.commentLine = true;
+          if(stream.eol()){
+            state.commentLine = false;
+          }
+          return "comment";
+        }
+        if(stream.eol()){
+          state.commentLine = false;
+        }
+      }
+    };
+  });
+CodeMirror.defineMIME("text/x-brainfuck","brainfuck")
+});