hg.mo operational updates

[Gregory Szorc]

A handful of changes were recently made to hg.mozilla.org that could affect
various consumers.

First, the service was upgraded from Mercurial 4.7.2 to Mercurial 4.8 a few
hours ago.

We also started recently serving static assets from /static/ URLs with
"Cache-Control: max-age=X, immutable" headers. Previously, we were serving
static assets from <repo>/static/ URLs without reasonable caching headers.
The use of aggressive Cache-Control headers should result in page loads in
1 RTT since browsers should have static assets cached after first page
load. i.e. pages should load much faster.

We also tweaked the CSP policy to deny script loads from
https://hg.mozilla.org/ that don't come from /static/ or don't have a nonce
in the <script> element. Historically, some people have relied on the fact
that hg.mozilla.org can be abused to act as a web server of sorts for
arbitrary content hosted in version control. This is a security concern and
we're putting an end to it. Exceptions can be granted on a case-by-case
basis. If the CSP policy broke something important, let us know and we can
possibly restore things for your URLs.

Finally, with the upgrade to Mercurial 4.8, we were able to (re-)enable the
fastannotate feature, which ships as part of Mercurial 4.8. It is currently
only enabled on the experimental/mozilla-central-cvs repo. Servers are
still building data caches, but annotate URLs on that repo should load much
faster than other repos. e.g.
https://hg.mozilla.org/experimental/mozilla-central-cvs/annotate/59a1544b68fd/js/src/jsapi.cpp
loads in 5s versus 15s for
https://hg.mozilla.org/mozilla-central/annotate/6e842238034c/js/src/jsapi.cpp.
On the command line, `hg fastannotate` completes in ~0.4s (`git annotate`
completes in ~15s).

As always, make noise if something looks wrong.