Social sign-in: avoid re-authorization in `users_controller#create`

It does not add any additional guards against malicious users:

Malicious user may attempt to invoke `POST /users/new` with bogus
values for `auth_provider` and `auth_uid` resulting
with a new account to which user would have a way to login, other than
sending a password reset request.

In some cases, re-authorization would introduce additional
"Please login to your social account", or "Are you sure you want to be logged in"
popup triggered by identity provider.

This PR removes the re-authorization request from `POST /users/new` in authorization flow.

Merge remote-tracking branch 'upstream/pull/4842'

Merge remote-tracking branch 'upstream/pull/4828'

Merge remote-tracking branch 'upstream/pull/4846'

Add proper referrer for authorization scenario

Fixes the following:
- `users_controller#new` loses referer in authorization scenario, when it was invoked after social signup succeded
- the second invocation of `auth_success`, triggered by re-authorization initiated from `users_controller#create`
  does not have referrer field set
- as a result, the final welcome screen does not offer final authorization, and drops into ID instead

Introduced by #4758.

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4844'

Merge remote-tracking branch 'upstream/pull/4838'

Merge remote-tracking branch 'upstream/pull/4837'

Merge remote-tracking branch 'upstream/pull/4836'

Merge remote-tracking branch 'upstream/pull/4835'

Merge remote-tracking branch 'upstream/pull/4841'

Merge remote-tracking branch 'upstream/pull/4840'

Replace png directions icon with inline svg

Truncate username in user menu

Adjust vertical alignment of user button contents

Increase secondary nav item padding to compensate removed whitespace

Use Bootstrap .nav in secondary header navigation

update script-src CSP rules for iD

allow data URIs for images in iD

Remove unused #container css

Replace .btn-wrapper with Bootstrap gutters/gaps

Remove unused .browse_status css class

Remove custom css from "Load Data" button

Merge remote-tracking branch 'upstream/pull/4832'

Merge remote-tracking branch 'upstream/pull/4833'

Merge remote-tracking branch 'upstream/pull/4829'

Merge remote-tracking branch 'upstream/pull/4831'

Merge remote-tracking branch 'upstream/pull/4830'

Remove custom css from note descriptions

Remove custom css from "Enable overlays" text

Bump osm-community-index from 5.6.3 to 5.7.0

Bumps [osm-community-index](https://github.com/osmlab/osm-community-index) from 5.6.3 to 5.7.0.
- [Release notes](https://github.com/osmlab/osm-community-index/releases)
- [Changelog](https://github.com/osmlab/osm-community-index/blob/main/CHANGELOG.md)
- [Commits](https://github.com/osmlab/osm-community-index/compare/v5.6.3...v5.7.0)

---
updated-dependencies:
- dependency-name: osm-community-index
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump leaflet.locatecontrol from 0.81.0 to 0.81.1

Bumps [leaflet.locatecontrol](https://github.com/domoritz/leaflet-locatecontrol) from 0.81.0 to 0.81.1.
- [Changelog](https://github.com/domoritz/leaflet-locatecontrol/blob/gh-pages/CHANGELOG.md)
- [Commits](https://github.com/domoritz/leaflet-locatecontrol/compare/v0.81.0...v0.81.1)

---
updated-dependencies:
- dependency-name: leaflet.locatecontrol
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Keep header h1 height equal to default header height

Adjust vertical alignment of user button contents

Increase secondary nav item padding to compensate removed whitespace

Use Bootstrap .nav in secondary header navigation

Merge remote-tracking branch 'upstream/pull/4826'

Fixed "Tab alignment" issue described in #4773

Fixed "Tab alignment" for "Sign up" button issue described in #4773 and #4826

Merge remote-tracking branch 'upstream/pull/4826'

Fixed "Tab alignment" for "Sign up" button issue described in #4773 and #4826

Fixed "Tab alignment" issue described in #4773

Merge remote-tracking branch 'upstream/pull/4827'

Fixed "Top menu buttons" issue mentioned in the #4773

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4823'

Merge pull request #4627 from tomhughes/security-policy

Switch to using rails builtin content security policy support

Switch to using rails builtin content security policy support

Merge pull request #4756 from tomhughes/text-muted

Replace deprecated text-muted class with text-body-secondary

Merge pull request #4758 from tomhughes/login-referer

Stop using the session to persist the referer during login

Merge pull request #4816 from tomhughes/login-focus

Make the login and signup screens focus on the first input

Replace deprecated text-muted class with text-body-secondary

Merge pull request #4824 from AntonKhorev/no-user-button

Remove unnecessary user menu wrapper

Remove unnecessary user menu wrapper

Use .icon-link to align logo

Merge remote-tracking branch 'upstream/pull/4822'

Drop bogus html.dir from ne locale

Fix new rubocop warnings

Update bundle

Remove inbox template and anchor id

Localisation updates from https://translatewiki.net.

Make the login and signup screens focus on the first input

Fixes #4814

Merge remote-tracking branch 'upstream/pull/4795'

Merge remote-tracking branch 'upstream/pull/4812'

Merge remote-tracking branch 'upstream/pull/4811'

Merge remote-tracking branch 'upstream/pull/4810'

Merge remote-tracking branch 'upstream/pull/4808'

Merge remote-tracking branch 'upstream/pull/4809'

Merge remote-tracking branch 'upstream/pull/4804'

chore: typo

chore: clarify email reply text

Don't skip heading levels on "fixthemap" page

Remove unused .button class

Fix css section comments

Set check/x display property using .d-block

Remove font size class from "Start mapping" container

It doesn't affect the button font, only the spacing around.

Remove .clearfix

Floats are no longer used on the welcome page.

Replace .term sprite class with .d-flex container

Convert basic terms to a list

Remove .small sprite class

.small is used to set the font size elsewhere.

Bump eslint from 9.2.0 to 9.3.0

Bumps [eslint](https://github.com/eslint/eslint) from 9.2.0 to 9.3.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v9.2.0...v9.3.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Fix white circular elements of welcome sprite

Bump rexml from 3.2.6 to 3.2.8

Bumps [rexml](https://github.com/ruby/rexml) from 3.2.6 to 3.2.8.
- [Release notes](https://github.com/ruby/rexml/releases)
- [Changelog](https://github.com/ruby/rexml/blob/master/NEWS.md)
- [Commits](https://github.com/ruby/rexml/compare/v3.2.6...v3.2.8)

---
updated-dependencies:
- dependency-name: rexml
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Update to rails 7.1.3.3

OpenID connect icons to SVG

re-add whitespace

trigger CI

revert size attribute

Merge pull request #4803 from tomhughes/preference-encoding

Fix exception uploading a unicode preference value

Merge remote-tracking branch 'upstream/pull/4802'

Treat the body as UTF-8 for user_preferences#update

Test unicode values in user preference keys and values

Localisation updates from https://translatewiki.net.

Merge pull request #4800 from AntonKhorev/welcome-stack

Stack welcome page columns on small screens

Merge pull request #4680 from tomhughes/validate-page-numbers

Add parameter validation to pagination

Stack welcome page columns on small screens

Make it similar to the fixthemap page.

Remove groups

Remove transforms from groups

Merge pull request #4633 from tomhughes/trace-images

Trace image cleanups

Remove transforms from circles

Remove fill rule style

Merge pull request #4496 from tomhughes/disabled-auth-error

Return an error when a disabled authentication mechanism is used

Remove line join styles for circles