Bump brakeman from 4.8.2 to 4.9.0

Bumps [brakeman](https://github.com/presidentbeef/brakeman) from 4.8.2 to 4.9.0.
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](https://github.com/presidentbeef/brakeman/compare/v4.8.2...v4.9.0)

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/2751'

Bump rotp from 6.0.0 to 6.1.0

Bumps [rotp](https://github.com/mdp/rotp) from 6.0.0 to 6.1.0.
- [Release notes](https://github.com/mdp/rotp/releases)
- [Changelog](https://github.com/mdp/rotp/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mdp/rotp/compare/v6.0.0...v6.1.0)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/2750'

Merge remote-tracking branch 'upstream/pull/2749'

Merge remote-tracking branch 'upstream/pull/2748'

Merge remote-tracking branch 'upstream/pull/2747'

Bump autoprefixer-rails from 9.8.6 to 9.8.6.1

Bumps [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) from 9.8.6 to 9.8.6.1.
- [Release notes](https://github.com/ai/autoprefixer-rails/releases)
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ai/autoprefixer-rails/compare/9.8.6...9.8.6.1)

Signed-off-by: dependabot[bot] <support@github.com>

Bump activerecord-import from 1.0.5 to 1.0.6

Bumps [activerecord-import](https://github.com/zdennis/activerecord-import) from 1.0.5 to 1.0.6.
- [Release notes](https://github.com/zdennis/activerecord-import/releases)
- [Changelog](https://github.com/zdennis/activerecord-import/blob/master/CHANGELOG.md)
- [Commits](https://github.com/zdennis/activerecord-import/compare/v1.0.5...v1.0.6)

Signed-off-by: dependabot[bot] <support@github.com>

Bump eslint from 7.5.0 to 7.6.0

Bumps [eslint](https://github.com/eslint/eslint) from 7.5.0 to 7.6.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.5.0...v7.6.0)

Signed-off-by: dependabot[bot] <support@github.com>

Bump aasm from 5.0.8 to 5.1.0

Bumps [aasm](https://github.com/aasm/aasm) from 5.0.8 to 5.1.0.
- [Release notes](https://github.com/aasm/aasm/releases)
- [Changelog](https://github.com/aasm/aasm/blob/master/CHANGELOG.md)
- [Commits](https://github.com/aasm/aasm/compare/v5.0.8...v5.1.0)

Signed-off-by: dependabot[bot] <support@github.com>

Fix some rubocop todos

Register warning and error flash types

Fixes #2743

Fix rubocop warning

Switch to bundler 2.x

Target ruby 2.7 for rubocop checks

Run tests on ruby 2.7.0 to match production systems

Restore erblint workaround

Fix some rubocop todos

Update rubocop todo

Merge remote-tracking branch 'upstream/pull/2742'

Merge remote-tracking branch 'upstream/pull/2741'

Fix the Command Injection warnings from Brakeman

Update to iD v2.18.4

Bump autoprefixer-rails from 9.8.5 to 9.8.6

Bumps [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) from 9.8.5 to 9.8.6.
- [Release notes](https://github.com/ai/autoprefixer-rails/releases)
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ai/autoprefixer-rails/compare/9.8.5...9.8.6)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge pull request #2737 from openstreetmap/dependabot/bundler/strong_migrations-0.7.1

Bump strong_migrations from 0.7.0 to 0.7.1

Bump strong_migrations from 0.7.0 to 0.7.1

Bumps [strong_migrations](https://github.com/ankane/strong_migrations) from 0.7.0 to 0.7.1.
- [Release notes](https://github.com/ankane/strong_migrations/releases)
- [Changelog](https://github.com/ankane/strong_migrations/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ankane/strong_migrations/compare/v0.7.0...v0.7.1)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/2734'

turn_costs=true only for car

I know there was a bit forth and back in #2695 and my last recommendation was to use turn_costs=true. This was not intended for bike and foot.

Merge remote-tracking branch 'upstream/pull/2731'

Merge pull request #2730 from openstreetmap/dependabot/bundler/bootsnap-1.4.7

Bump bootsnap from 1.4.6 to 1.4.7

Merge pull request #2729 from Firefishy/remove-legacy-openlayers

Remove legacy OpenLayers files

Bump strong_migrations from 0.6.8 to 0.7.0

Bumps [strong_migrations](https://github.com/ankane/strong_migrations) from 0.6.8 to 0.7.0.
- [Release notes](https://github.com/ankane/strong_migrations/releases)
- [Changelog](https://github.com/ankane/strong_migrations/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ankane/strong_migrations/compare/v0.6.8...v0.7.0)

Signed-off-by: dependabot[bot] <support@github.com>

Bump bootsnap from 1.4.6 to 1.4.7

Bumps [bootsnap](https://github.com/Shopify/bootsnap) from 1.4.6 to 1.4.7.
- [Release notes](https://github.com/Shopify/bootsnap/releases)
- [Changelog](https://github.com/Shopify/bootsnap/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Shopify/bootsnap/compare/v1.4.6...v1.4.7)

Signed-off-by: dependabot[bot] <support@github.com>

Remove legacy OpenLayers

Remove legacy OpenLayers code, which for www.openstreetmap.org is
now managed by https://github.com/openstreetmap/chef/tree/master/cookbooks/web/files/default/static/openlayers

Fix the CrossSiteScripting warnings from Brakeman

Merge remote-tracking branch 'upstream/pull/2727'

Merge remote-tracking branch 'upstream/pull/2725'

Fix the Redirect warnings from Brakeman

Unfortunately I've had to leave the check disabed as Brakeman
can't see inside the safe_referer method so doesn't realise that
it is cleaning the referer.

Use the worldCopyJump option for leaflet overlays

This means that if you pan to a 'copy' of the world, the overlays
reappear on that copy.

Fixes #2040

Add some changsets that shouldn't be selected

Merge remote-tracking branch 'upstream/pull/2726'

Update to iD v2.18.3

Refactor changeset index testing to assert against objects, not db queries

This avoids the situation where tests pass despite an empty db.

Refs #2614

Refator way_full test to avoid relying on non-existant fixtures

Refs #2614

Merge remote-tracking branch 'upstream/pull/2723'

Merge remote-tracking branch 'upstream/pull/2724'

Add a browse map link to notes

This matches the one for nodes. Fixes #1355. Replacement for #1773.

An unstyled list works better for the details section, particularly
when all three are shown.

Use a named path instead of explicit controllers and actions

Use Brakeman for static code analysis

Merge remote-tracking branch 'upstream/pull/2722'

Bump aws-sdk-s3 from 1.74.0 to 1.75.0

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.74.0 to 1.75.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/2720'

Update to iD v2.18.2

Use legacy build of iD

Properly include iD's external data files

Update iD initialization for v2.18.1

Update to iD v2.18.1

Localisation updates from https://translatewiki.net.

Update to iD v2.18.0

Merge remote-tracking branch 'upstream/pull/2719'

Merge remote-tracking branch 'upstream/pull/2718'

Bump rubocop-performance from 1.7.0 to 1.7.1

Bumps [rubocop-performance](https://github.com/rubocop-hq/rubocop-performance) from 1.7.0 to 1.7.1.
- [Release notes](https://github.com/rubocop-hq/rubocop-performance/releases)
- [Changelog](https://github.com/rubocop-hq/rubocop-performance/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop-hq/rubocop-performance/compare/v1.7.0...v1.7.1)

Signed-off-by: dependabot[bot] <support@github.com>

Bump eslint from 7.4.0 to 7.5.0

Bumps [eslint](https://github.com/eslint/eslint) from 7.4.0 to 7.5.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.4.0...v7.5.0)

Signed-off-by: dependabot[bot] <support@github.com>

Fix eslint warnings

Drop ch.disable from graphhopper parameters

Merge remote-tracking branch 'upstream/pull/2712'

Bump lodash from 4.17.15 to 4.17.19

Bumps [lodash](https://github.com/lodash/lodash) from 4.17.15 to 4.17.19.
- [Release notes](https://github.com/lodash/lodash/releases)
- [Commits](https://github.com/lodash/lodash/compare/4.17.15...4.17.19)

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/2695'

Merge remote-tracking branch 'upstream/pull/2711'

Remove unused warning css

Convert data feature warning to use bootstrap alert

Also rearrange dialog to fit with standard sidebar layouts, so that
the close icon and load buttons are not within the paragraph.

There may be a better way to construct this!

Convert warnings to use bootstrap alerts

The new note is guidance, rather than a warning, so it gets the info
background

Merge remote-tracking branch 'upstream/pull/2710'

Merge remote-tracking branch 'upstream/pull/2709'

Rephrase 'replying' text to clarify what will actually happen

Fixes #2166

Remove unnecessary css

Images have no border in modern browsers, and bootstrap's reset also
sets this.

Remove unused css

Use bootstrap backgrounds and text utilities for read issue reports

Rename nav-related body classes

This makes it clearer that the classes are only for navigation menu
matters. Other things should be done on media queries, or ideally,
using bootstrap components like grids.

This has a side effect of removing the smaller font size from the
body when the navigation menu is in the small-nav state.

Move the login form rules to be based on screen size

Ideally this would be refactored to be mobile-first, but is likely
to be replaced by more general bootstrap form refactoring anyway.

Remove webkit-appearance: none

This is the default anyway, and we don't need this for anything specific.

Rework the about header size change to be based on the screen width, not the menu state

Also reworks to be mobile-first

Remove dead CSS code - nothing has the user_map class

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/2707'

Bump autoprefixer-rails from 9.8.4 to 9.8.5

Bumps [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) from 9.8.4 to 9.8.5.
- [Release notes](https://github.com/ai/autoprefixer-rails/releases)
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ai/autoprefixer-rails/compare/9.8.4...9.8.5)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge pull request #2702 from openstreetmap/dependabot/bundler/aws-sdk-s3-1.74.0

Bump aws-sdk-s3 from 1.73.0 to 1.74.0

Merge pull request #2701 from openstreetmap/dependabot/bundler/factory_bot_rails-6.1.0

Bump factory_bot_rails from 6.0.0 to 6.1.0

Bump aws-sdk-s3 from 1.73.0 to 1.74.0

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.73.0 to 1.74.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Bump factory_bot_rails from 6.0.0 to 6.1.0

Bumps [factory_bot_rails](https://github.com/thoughtbot/factory_bot_rails) from 6.0.0 to 6.1.0.
- [Release notes](https://github.com/thoughtbot/factory_bot_rails/releases)
- [Changelog](https://github.com/thoughtbot/factory_bot_rails/blob/master/NEWS.md)
- [Commits](https://github.com/thoughtbot/factory_bot_rails/compare/v6.0.0...v6.1.0)

Signed-off-by: dependabot[bot] <support@github.com>

Fix eslint warning

Merge remote-tracking branch 'upstream/pull/2698'

Merge remote-tracking branch 'upstream/pull/2696'

Allow image loading from tileserver.memomaps.de

Merge remote-tracking branch 'upstream/pull/2670'