Tor Browser for Windows 6.5

# All Platforms
- Update Firefox to 45.7.0esr.
- Tor to 0.2.9.9.
- OpenSSL to 1.0.2j.
# Update Torbutton to 1.9.6.12.
- Timezone spoofing moved to tor-browser.git.
- Move referrer spoofing for .onion domains into tor-browser.git.
- Block addon resource and url fingerprinting with nsIContentPolicy.
- Allow the directory listing stylesheet in the content policy.
- Whitelist internal URLs that Firefox requires for media.
- Avoid SOCKS auth and NEWNYM collisions when sharing a tor client.
- Improve external app launch handling and associated warnings.
- Remove/synchronize Torbutton SOCKS pref logic.
- GETINFO response parser doesn't handle AF_UNIX entries + IPv6.
- Make "JavaScript disabled" more visible in Security Slider.
- Use pt-BR strings from now on.
- Add links to Tor Browser User Manual.
- Fix non-rendering arrow on OS X.
- Fix bad preferences.xul dimensions.
- Use DuckDuckGo on about:tor.
- Hide the update check menu entry when running under the sandbox.
- Move resizing code to tor-browser.git.
- Change security slider to 3 options.
- Enhance security slider's custom mode.
- Disable remote jar on all security levels.
- Move privacy checkboxes to about:preferences#privacy.
- Add tooltips to explain our privacy checkboxes.
- Allow security settings dialog to resize.
- Remove 'Restore Defaults' button.
- Prevent redundant dialogs opening.
- Remove helpdesk link from about:tor.
- Add links for pt, es, and fr Tor Browser manuals.
- Remove obsolete StartPage locale strings.
- Remove 2016 donation banner.
- Remove obsolete toolbar button code.
- Remove unused Torbutton code and strings.
- Code clean-up.
- Translation updates
# Update Tor Launcher to 0.2.10.3.
- Set CurProcD for Thunderbird/Instantbird.
- Remove special handling for Instantbird/Thunderbird.
- Translation updates.
# Update HTTPS-Everywhere to 5.2.9.
# Update NoScript to 2.9.5.3.
- Spoof timezone with Firefox patch.
- Spoof referrer when leaving a .onion domain.
- Write C++ patch for external app launch handling.
- Size new windows to 1000x1000 or nearest 200x100 (Firefox patch).
- Mark JIT pages as non-writable.
- Always block remote jar files.
- Reduce timing precision for AudioContext, HTMLMediaElement, and MediaStream.
- Remove support for SHA-1 HPKP pins.
- KeyboardEvents are only rounding to 100ms.
- Isolate preconnect requests to URL bar domain.
- Prevent millisecond resolution leaks in File API.
- Allow javascript: links from HTTPS first party pages.
- Move privacy checkboxes to about:preferences#privacy.
- Fix broken preferences tab in non-en-US alpha bundles.
- Fix wrong update URL in alpha bundles.
- Point the update URL to aus1.torproject.org.
- Start using pt-BR instead of pt-PT for Portuguese.
- Backport fix for local path disclosure after drag and drop.
- Backport fix for broken MP3-playback.
- Isolate SharedWorker script requests to first party.
- Add script to run all Tor Browser regression tests.
- DuckDuckGo does not work with JavaScript disabled.
- Enhance about:tbupdate page.
- Code clean-up.
# Windows
- On Windows, check TZ for timezone first.
- Maximizing window and restarting leads to non-rounded window size.
- Rounded inner window accidentally grows to non-rounded size.
# OS X
- Badly resized window due to security slider notification bar on OS X.
- Make the build PIE on OSX.
# Linux
- Updater breaks if unix domain sockets are used.
- Weird resizing dance on Tor Browser startup.
# Build system
* All platforms
- Upgrade Go to 1.7.4.
- Make the downloads.json file reproducible.
- Don't apply OpenSSL patch anymore.
- Set MOZ_BUILD_DATE based on Firefox version.
- Remove some uses of libfaketime.
- Make zip and tar helpers generate reproducible archives.
# OS X
- Make OS X Tor archive reproducible again.
- Make OS X builds reproducible (use clang for compiling tor).
- Make OS X builds reproducible (getting libfaketime back).
- Fix incremental updates by taking signatures into account.
- In dmg2mar, extract old mar file to copy permissions to the new one.