Security and patch rollup for FPR7 from ESR52

[classilla]

Currently just pins and certs.

[classilla]

Through c273538785e3

Not relevant:
M1433609 (e10s only)
M1409440 (we don't compile or use this code)
M1441941 (no Skia)
M1449350 (not on Windows)
M1448705 (code does not exist)

Not taking:
M1361699 (not likely to be helpful)
M1445582 (not an issue)
M1451376 (IPC related and our printer system is already fragile enough)

Deferred:
M1449574 (all tzones to be updated en masse in #447)
M1449548 (doesn't seem helpful, but we need more info)
M1444668 (needs more study but probably will take in FPR7 final)

Candidates:
M1443891 https://hg.mozilla.org/releases/mozilla-esr52/rev/17201199b18d
M1444231 https://hg.mozilla.org/releases/mozilla-esr52/rev/57bd35fa8618
M1443092 https://hg.mozilla.org/releases/mozilla-esr52/rev/b8c430253efd
M1448774 https://hg.mozilla.org/releases/mozilla-esr52/rev/05cadfa3ac390eba43a9b0011544a3bd24cfb0ce
M1452416 https://hg.mozilla.org/releases/mozilla-esr52/rev/f89ab96a2532

[classilla]

Through ba683a9558e1

Not relevant:
M1452619 (Windows irregularity)
M1453127 (code doesn't exist)

Not taking:
M1453339. I'm not sure we're affected, and the code is very different.

Deferred:
M1411415. This is probably safe, and we likely are affected in similar ways, but this is very difficult to exploit.
There are probably other sections of code that are affected as well, so this needs review.

Candidates:
M1452075 https://hg.mozilla.org/releases/mozilla-esr52/rev/608e76ec5ba2 (separate)
M1393367 https://hg.mozilla.org/releases/mozilla-esr52/rev/1ab40761a856 (seems unlikely but can't hurt)
M1452202 https://hg.mozilla.org/releases/mozilla-esr52/rev/134c728799c1

[classilla]

Through da7a355f2f41

Not relevant:
M1454692 (Skia only)
M1447080 (Windows)

Not taking:
M1426129 (WebRTC off)

Deferred:

Candidates:

[classilla]

After consideration, I've decided not to take M1444668. It could have a performance impact on codegen and we don't enable, nor support, wasm (since we don't enable, nor support, asm.js). However, we can be nailed by M1449548, so we will take that.