fix: Use local port to avoid triggering the firewall

[Rob--W]

When web-ext run starts, the following prompt shows briefly on macOS:

Do you want the application "node" to
accept incoming network connections?

This is because we use listen(0) to find a port, and by default, this
method listens on any network interface.

Since we are only looking for free ports and not network connections,
limit listen() to localhost only.

[rpl]

@Rob--W it looks that the CI job is currently failing because flow expects a different function signature:
https://travis-ci.org/mozilla/web-ext/jobs/647323742#L241-L257

I haven't tried to apply the change locally, but it may be enough to pass an explicit undefined as the third parameter that flow expects (backlog) and pass the callback as the forth parameter.

[Rob--W]

This is a common signature, so I'll submit a PR against flow. Then we can merge it in #1746.

[Rob--W]

Patch is up at facebook/flow#8290

[Rob--W]

I added a FLOW_FIXME comment. flow is supposed to support us in making our code better, not block us from landing otherwise good patches.

Once my upstream patch is merged, I'll follow up here.

[coveralls]

Coverage remained the same at 100.0% when pulling 55bc11c on Rob--W:port-listen-local-only into 4c612ee on mozilla:master.

[rpl]

I added a FLOW_FIXME comment. flow is supposed to support us in making our code better, not block us from landing otherwise good patches.

Once my upstream patch is merged, I'll follow up here.

Sure, I was going to suggest that too, no need to wait for the upstream fix for just the two places we had to mark with the flow fixme annotation.