Production mode shows some debug information

This ticket is a revamp of #7751 as per stale bot request.

• Vaadin Framework version
  7.7.13 and also 8.4.2

• Browser version
  Google Chrome 67.0.3396.62 64 bit

• Web container name and version
  Apache tomcat 8.5.31, Java 1.8.172

• Description of the bug
  We have several web applications done with Vaadin, paid third parties do Vulnerability Assessments and Penetration Tests on our applications in order to ensure the customers that the application is as secure as possible.
  We have received a complaint that it is still possible to read debug information from our webapps, even if we have set the productionMode param to true in the web.xml. The trick is to look at the browser console (further details in next bullet points).

• Minimal reproducible example
  Open browser, digit the url of a running web application (which was deployed with the productionMode param set to true) and launch it. Open the browser console (F12 in Chrome) and clear the console. Now append ?debug to the url and press enter, the browser console should fill with a lot of extra information not generally visible (further details in the next bullet points).

• Expected behavior
  The console should show little or no logs as much as when the ?debug param is absent.

• Actual behavior
  It shows a lot of debug log information:
  Vaadin bootstrap loaded
vaadinBootstrap.js?v=7.7.13:14 init application AppName {theme: "ThemeName", versionInfo: {…}, widgetset: "widgetsetName", widgetsetReady: true, comErrMsg: {…}, …}
vaadinBootstrap.js?v=7.7.13:14 loadTheme ...themeInfos...
vaadinBootstrap.js?v=7.7.13:14 load widgetset ...widgetsetInfos...
vaadinBootstrap.js?v=7.7.13:14 Fetching root config
vaadinBootstrap.js?v=7.7.13:14 sending request to ...urlInfos...
vaadinBootstrap.js?v=7.7.13:14 Got root config response {"v-uiId":0, ...bigJSON...}
vaadinBootstrap.js?v=7.7.13:14 Setting pending startup AppName
vaadinBootstrap.js?v=7.7.13:14 Widgetset registered widgetsetName
vaadinBootstrap.js?v=7.7.13:14 Starting from register widgetset AppName

• Possible Remediation
  The VA&PT consultants suggested us to assign to the logger a void function in order to avoid logging debug information: var log = function(){};.

Reproduce the behavior using the productionMode setting in web.xml and the ?debug URL described in the issue, then inspect the logged output from vaadinBootstrap.js. Done means production deployments no longer emit the listed debug messages when ?debug is appended, while normal startup still works.