firefox, firefox-bin: 60.0.2 -> 61.0, firefox-esr: 52.8.1esr -> 52.9.0esr, 60.0.2esr -> 60.1.0esr, nss: 3.36.4 -> 3.38 [Critical security fixes]

[taku0]

Motivation for this change

• Critical security fixes
• Other improvements and fixes

https://www.mozilla.org/en-US/firefox/61.0/releasenotes/
https://www.mozilla.org/en-US/firefox/60.1.0/releasenotes/
https://www.mozilla.org/en-US/firefox/52.9.0/releasenotes/
https://www.mozilla.org/en-US/security/advisories/mfsa2018-15/

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Fits CONTRIBUTING.md.

---

[andir]

The changes look good so far. For version >=61 you might want to remove system hunspell support (https://bugzilla.mozilla.org/show_bug.cgi?id=1460600).

[taku0]

Sorry, I didn't notice the existing PR. Incorporated changes from #42631.

[vcunat]

I briefly tested these on x86_64-linux, and all 18.03* channels now contain this. The rebuild isn't really that big (a couple thousand).