replaceUrlPrefixWithRandomMirror() is not meant to be called twice on
the same elements and this leads to the URL of the mirror being mangled.

This commit introduces another class (.use-mirror-pool-on-retry) on
which replaceUrlPrefixWithRandomMirror() is called when the verification
fails. The download button with .use-mirror-pool gets hidden and
replaced by one with .use-mirror-pool-on-retry.

This not very elegant but probably the simplest solution.

With some JavaScript to display the message only in Firefox 52.

This paragraph was basically saying the same as the introduction of WoT
(and a second time in the body of the WoT section).

Keeping in mind that this information is display to everybody
downloading Tails and that a proper WoT verification is very complicated
to perform, let's explain the difference between "basic" and "WoT" only
once.

The detailed explanation of the threat at the beginning of the WoT
toggle is still and complementary with the summary of the WoT section.