The MenuBar is quite specific to the canonical version of the online
Scratch editor [1]. We want to make use of the scratch-gui package
without displaying the MenuBar.

Since the height of the menu bar is hard-coded as a CSS variable, I've
had to override the height calculation for the body wrapper when the
menu bar is not visible. Ideally the height of the menu bar wouldn't be
hard-coded and this wouldn't be necessary.

[1]: https://scratch.mit.edu/projects/editor

This is specific to the RPF CodeClubWorld app and should not be merged
into the main "develop" branch or pushed to the upstream repo.

I don't think we need the deploy-npm or push-translations workflows.

The `npm run deploy -- -e $CIRCLE_BRANCH` step in the deploy-gh-pages
job appears to make use of the gh-pages `-e` option [1] to publish the
changes to the gh-pages branch within a sub-directory named after the
current branch. I've retained this functionality given that it may well
be useful if we want to try out changes without affecting production.

[1]: scratchfoundation/gh-pages@e0dd4ea#diff-558572b6f7bd7068bbbd3db502651a5a313bfc3901d72eb2995833592e4434edR30

I followed these instructions [1] to create the key and add it to GitHub
and CircleCI.

[1]: https://circleci.com/docs/2.0/gh-bb-integration/#creating-a-github-deploy-key

I want to be able to send an X-CSRF-Token HTTP header when sending a
POST or PUT request to create or update the project.

* Exporting saveProjectToServer means that I can set the
onUpdateProjectData property to a function which wraps
saveProjectToServer.

* Adding the optional headers parameter to the saveProjectToServer
function means that the wrapping function can pass in extra HTTP headers
to be sent in any request.

This reinstates the deploy-npm CircleCI job and tweaks it slightly:

* Scope the package name by organisation. This ties the package to the
RPF organisation rather than just to my user and means that, for
example, any member of the organisation can publish the package.

* Only publish package on successful builds of the code-club-world
branch.

* Use organisation-specific release version and git tag to avoid
confusion with versions in the canonical package and tags in upstream
repo.

* Always publish using "latest" npm tag; not "hotfix" or "stable".

* Add `--access public` option to `npm publish` command, because scoped
packages only allow "restricted" access by default.

* I've added the access token from my npmjs.org account as the NPM_TOKEN
env var in the CircleCI project settings.

* Add ssh key fingerprint to allow `git push`.

These are used by npmjs.org to display links on the package page. Since
this is a public package I think it's sensible to point at our fork of
the canonical repo.

In ./src/containers/costume-tab.jsx:271 the SpriteSelctorItem
`dragPayload` prop is set to be an object. To supress the prop type
warning, I've added `propTypes.object` to the array of allowed types.

We've seen a PropType warning for this prop in development. It seems
that when the SpriteList component is used to manage the costumes in
the left hand side of the Costumes tab, numeric identifiers are used
for `sprite`. When the SpriteList is used in the sprite selection area
under the stage, strings are used. There's probably a way of fixing
this at source, but for now being a bit more permissive with the
validation removes the warning. As far as I can tell from reading the
source, we use this id for comparison with the `===` operator, so I
think numbers or strings are functionally equivalent.

Bump color shade

Fix nav images alt