refactor(templates): the shared page scripts load from static files

A step towards a Content-Security-Policy without inline scripts. The
scripts every page or many pages share now load from static files: the
error focus of base.html, the please-wait dialog, the sign-in forms'
password toggle and busy button, the jobs pages' reload while a job
runs, and the start of the job panel and of the VM list's state poll,
whose values come as json_script data. Cancel links go back through a
data-history-back attribute instead of a javascript: URL. The IE8
html5shiv/respond.js block, X-UA-Compatible and shrink-to-fit are gone:
no supported browser reads them.

templates/error.html

@@ -23,7 +23,7 @@
                     </div>
 
                     <div class="d-grid d-sm-flex gap-2 mt-4">
-                        <a class="btn btn-primary" href="javascript:history.back()">
+                        <a class="btn btn-primary" href="#" data-history-back>
                             <i class="bi bi-arrow-left me-1" aria-hidden="true"></i>
                             {% trans "Back" %}
                         </a>