Keep assets locally instead of remote for privacy and CORS reasons

Having a local development server without https, I got a mixed content error in query explorer. The regular data browser works. Since I don't use any https locally, I found out that this error came from https://opensource.appbase.io/mirage/dist/js/vendor.min.js and was wondering why it's a remote url. In the network requests, I saw a horrible bunch of requests to remote requests to opensource.appbase.io and also others like stackpath.bootstrapcdn.com.

Because this js file got loaded from https, it's not possible to use my local host without https. That's a problem since I don't have any certificate. I don't see any reason for this locally, since self signed certificates causes extra work and trouble.

And fetching so much ressources over the internet from third party systems is also a privacy issue that's not expected from a on-prem hosted software. I use this with Docker on the same machine where Elasticsearch is hosted.

So please move those remote ressources locally for the on prem version. This would fix both problems with privacy/security and also mixed content issues because when they got remoted locally, I don't have https enabled so firefox wouldn't expect https for the elasticsearch connection.

## Workaround
[Disabling mixed content](https://support.mozilla.org/en-US/kb/mixed-content-blocking-firefox#w_unblock-mixed-content) could be a workaround, but it's just a workaround. Dejavu (which itself seems pretty nice) still relys on external ressources and expose me to them by those requests. This ticket is for a reasonable long term solution.