Remove settings.serviceUrl from the client and service entirely

Work was done for https://github.com/hypothesis/product-backlog/issues/215 to remove 90% of the cases where the client uses `settings.serviceUrl`.

There remains [one place where it's still used](https://github.com/hypothesis/client/blob/99e385b1a7c8e15a15c0b6a3ed63ec38d187fe31/src/sidebar/session.js#L55) which is to generate the `https://hypothes.is/app` endpoint to in order to send the cookie-authenticated profile request.

This doesn't affect people using publisher groups / third party accounts because they don't use this `/app` endpoint (they use a separate auth system that uses `/api/profile` instead). So this issue doesn't block releasing publisher groups, and the only reason to remove ` settings.serviceUrl` is for tidying up.

In the future we're planning to move away from cookie auth, so the `/app` endpoint will go away entirely and `/api/profile` will always be used instead. So it's not worthwhile to do the work necessary for `session.js` to get the `/app` endpoint without using `settings.serviceUrl` (we would have to add the `/app` URL to the list of links that `/api/links` returns and change `session.js` to get it from there, this would require refactoring `service-url.js` a little in order to allow `session.js` to wait for its links API request promise to return),

This ticket is just here to record that once `/app` is gone we should delete `settings.serviceUrl` from both the client and service entirely, as it'll no longer be used at all.

Start with the remaining settings.serviceUrl use in src/sidebar/session.js and review the service-side references. First confirm that the /app endpoint has gone away and that /api/profile is used instead; done means settings.serviceUrl is removed from both the client and service without leaving references.

Written by the indexing model from the issue text.