Bump eslint from 8.48.0 to 8.49.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.48.0 to 8.49.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.48.0...v8.49.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/4241'

Merge remote-tracking branch 'upstream/pull/4236'

Merge remote-tracking branch 'upstream/pull/4237'

Add user id to api trace output

Bump coverallsapp/github-action from 2.2.2 to 2.2.3

Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 2.2.2 to 2.2.3.
- [Release notes](https://github.com/coverallsapp/github-action/releases)
- [Commits](https://github.com/coverallsapp/github-action/compare/v2.2.2...v2.2.3)

---
updated-dependencies:
- dependency-name: coverallsapp/github-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Fix alignment in profile and diary location forms

Localisation updates from https://translatewiki.net.

Handle timeouts inside a view for API calls

Merge remote-tracking branch 'upstream/pull/4225'

Merge remote-tracking branch 'upstream/pull/4234'

Merge remote-tracking branch 'upstream/pull/4233'

Match the top spacing of the leaflet buttons to the gap between groups

This removes a usage of sass division operator

Use h2 as the main header on the map-ui panel

Use standard padding size for map-ui sidebar

The previous padding didn't match the main sidebar, and also used
sass division as part of the calculation.

Round the clickable map previews on the layer switcher

Most interactive elements on the site are rounded, so we can do the
same for these map previews.

Make the sharing controls read-only

They aren't used for inputting any information, only for copying.

Use bootstrap form controls for the link and html controls

Use bootstrap for share forms

This fixes alignment of the checkboxes, and uses bootstrap form
controls for the image format and scale inputs.

Move the custom dimensions input to beside the custom dimensions
display.

Mute hidden comment text in each table cell

Fix lack of margin on changeset browsing messages

The display area here uses negative margins to make the flush list
work, so we need to add them back in for normal text.

Merge remote-tracking branch 'upstream/pull/4232'

Use implicit style for associations with factory overrides

This matches our usage of implicit style for associations generally,
e.g. `user`.

Merge remote-tracking branch 'upstream/pull/4230'

Merge remote-tracking branch 'upstream/pull/4231'

Update argon2 tests for change in library default costs

Update bundle

Show user id on profile pages to moderators and admins

Mute hidden comment text in each table cell

Merge remote-tracking branch 'upstream/pull/4229'

Merge remote-tracking branch 'upstream/pull/4228'

Bump coverallsapp/github-action from 2.2.1 to 2.2.2

Bumps [coverallsapp/github-action](https://github.com/coverallsapp/github-action) from 2.2.1 to 2.2.2.
- [Release notes](https://github.com/coverallsapp/github-action/releases)
- [Commits](https://github.com/coverallsapp/github-action/compare/v2.2.1...v2.2.2)

---
updated-dependencies:
- dependency-name: coverallsapp/github-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump actions/checkout from 3 to 4

Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Swap older/newer diary entries buttons

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4223'

Merge remote-tracking branch 'upstream/pull/4222'

Merge remote-tracking branch 'upstream/pull/4221'

Remove unused partial _user.atom.builder

Add bbox parameter to notes search api

Check required bbox parameter presence outside of BoundingBox class

Drop non-functional check for nil email

Merge remote-tracking branch 'upstream/pull/4216'

Merge remote-tracking branch 'upstream/pull/4214'

Add some additional preloads to notes#feed

Move email-related methods to mixin

Add notes feed description for unspecified area

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4212'

Merge pull request #4211 from tomhughes/changeset-comment-cleanup

Address review comments for changeset comment limiting

Bump facebook API version

Improve testing of changeset comment rate limits

Move changeset comment rate limit check to a predicate method

Improve naming of changeset comment rate limit settings

Use bootstrap badges to implement count-number badges

This leaves bootstrap to take care of most aspects, while retaining
the current colours and font weights.

Merge remote-tracking branch 'upstream/pull/4210'

Merge remote-tracking branch 'upstream/pull/4209'

Use Activerecord '#or' method for queries

That let's us use relation names (like `sender`) and avoid dealing
directly with ids.

Use trace instead of gpx_id in queries

This makes the queries easier to read.

Avoid using _id in queries

This makes the queries shorter and easier to read.

Merge pull request #4193 from AntonKhorev/lookup-friend

Lookup friend user before make/remove friend action

Merge pull request #4197 from AntonKhorev/user-resources

Move user lookup/error methods from app controller to concerns

Merge pull request #4202 from tomhughes/changeset-comment-limit

Add rate limiting for changeset comments

Update bundle

Merge remote-tracking branch 'upstream/pull/4208'

Bump osm-community-index from 5.5.5 to 5.6.0

Bumps [osm-community-index](https://github.com/osmlab/osm-community-index) from 5.5.5 to 5.6.0.
- [Release notes](https://github.com/osmlab/osm-community-index/releases)
- [Changelog](https://github.com/osmlab/osm-community-index/blob/main/CHANGELOG.md)
- [Commits](https://github.com/osmlab/osm-community-index/compare/v5.5.5...v5.6.0)

---
updated-dependencies:
- dependency-name: osm-community-index
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4198'

Restore ordering of results from the users#index API call

Merge remote-tracking branch 'upstream/pull/4203'

Add checks to ensure that the response is empty

Merge remote-tracking branch 'upstream/pull/4204'

Sort users by their ids

Change tests to expect a successful (empty) response even if the user is not visible anymore

Bump eslint from 8.47.0 to 8.48.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.47.0 to 8.48.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.47.0...v8.48.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Use where instead of find to prevent 404

Add rate limiting for changeset comments

Fixes #4196

Test that suspended and deleted users can't use OAuth tokens

Logout while testing OAuth 1 token usage

This ensures we're not accidentally inheriting any session permissions.

Separate authenticating user from application owner in OAuth 1 tests

Localisation updates from https://translatewiki.net.

Make the TOTP cookie httponly

Update to rails 7.0.7.2

Update bundle

Add support for rate limiting signup requests

Lookup friend user before make/remove friend action

Lookup user before action in user's notes list

Render unknown user with concerns code in notes controller

Move user lookup and error render to concerns

Merge remote-tracking branch 'upstream/pull/4190'

Merge remote-tracking branch 'upstream/pull/4169'

Change provider name to "microsoft"

Add migration script

Update tests for microsoft_graph endpoints

Respond with plaintext when user not found in changeset query

The response used to be of type xml with empty body, which is not valid xml.

Merge remote-tracking branch 'upstream/pull/4187'

Merge remote-tracking branch 'upstream/pull/4186'

Replace links to donate.osm.org with supporting.osm.org

Expose note query limit values in api capabilities

Add missing changeset query limit capabilities test