In case the update server may deliver malicious content this would allow an adversary to inject arbitrary HTML into the response. So very bad stuff.

While signing the response would be better and something we can also do in the future (considering the code signing work), this is already a good first start.

Update davclient.js + adjust IE workaround for this

This makes it possible to also store custom properties passed through
the data object like tags or shareOwner.

- Add davclient.js lib
- Add es6-promise required by that lib
- Wrote IE8 workaround lib/shim for davclient.js

* includes local changes (ported them to upstream - see #10625)
* tipsy -> tooltip
* re-renders the element on scroll of a parent - fixes #20454