Enable publishers to use custom fonts in the client

Publishers can configure which fonts are used for certain parts of the sidebar, however those fonts currently have to be system font families which the browser already knows about.

Some (many?) publishers use custom fonts on their sites, using `@font-family` CSS declarations, and would like the client to use the same font in order to fit in with the look and feel of their pages. These fonts may be hosted on the publisher's own website, or possibly a third-party font service somewhere.

Some considerations:
- In future we'll probably want to set Content-Security-Policy headers when serving https://hypothes.is/app.html to restrict where scripts & styles in particular can be loaded from. Allowing arbitrary third-party fonts to be loaded in the client limits our ability to do this. We might want to consider limiting font URLs to a whitelist of locations.

Start by reviewing how the client configures sidebar fonts and how app.html could load publisher-hosted fonts. Define the supported font URL configuration and CSP constraints with maintainers; done means publishers can use custom fonts without weakening the client's security policy.

Written by the indexing model from the issue text.