Don't block keys intended for the browser

This allows the keys to be used for developer shortcuts, but also keeps the "if any key pressed" block working (and hacked key blocks).

This is mostly because it was annoying that Cmd-Opt-J didn't work, but seems like a good thing to have in general.

Glow flag/stop button when scripts are running

For now this uses the CSS `filter` property to crudely "highlight" for the active state. This is a temporary solution until we have a real design for the active states.

These were named inconsistently in scratch-vm

Fix string interpolation in costume-library

This removed our vendor files before. Prevent anything else from happening in the future

Set up base eslint config in .eslintrc.js

After doing this, new rules began applying for some reason:

`eol-last` only began taking the 'always' parameter as of 3.6.0, so I needed to update eslint.
`no-unused-var` started warning about process.env after updating the config structure
`comma-dangle` decided to start working, maybe because of the upgrade to eslint?  Autofixed with --fix

Actually lint React files

Includes rules missed in the first pass of eslint rules

Previously eslint ignored .jsx files :|

eslint-config-scratch: React + ES6 Edition

node relevant at the root, but not in src. Broser relevant in src, but not in root.

null !== undefined

Pin React devDependencies, add peerDependencies

When the package is installed as a dependency, it should warn the installer that React is a peerDependency.  When installed this way, the devDependencies won't be installed, so only one version of React will be present. However when it's installed as a standalone project, React should be installed automatically as a devDependency.

I think this gives us the best of both worlds — simple development setup as well as supporting usage as an installed package.