WebFront developer packages

Use a version-pinned bootstrap header and SHA-512. React and its dependencies are downloaded separately from npm.