Switch to Argon2 for password hashing

Merge remote-tracking branch 'upstream/pull/3357'

Merge remote-tracking branch 'upstream/pull/3356'

Bump actions/checkout from 2.3.5 to 2.4.0

Bumps [actions/checkout](https://github.com/actions/checkout) from 2.3.5 to 2.4.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2.3.5...v2.4.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump leaflet.locatecontrol from 0.74.0 to 0.74.1

Bumps [leaflet.locatecontrol](https://github.com/domoritz/leaflet-locatecontrol) from 0.74.0 to 0.74.1.
- [Release notes](https://github.com/domoritz/leaflet-locatecontrol/releases)
- [Changelog](https://github.com/domoritz/leaflet-locatecontrol/blob/gh-pages/CHANGELOG.md)
- [Commits](https://github.com/domoritz/leaflet-locatecontrol/compare/v0.74.0...v0.74.1)

---
updated-dependencies:
- dependency-name: leaflet.locatecontrol
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Update bundle

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3354'

Localisation updates from https://translatewiki.net.

Update to iD v2.20.2

Merge remote-tracking branch 'upstream/pull/3349'

Update bundle

Serve an updated TOTP token with the browse query response

Localisation updates from https://translatewiki.net.

Specify the controller when redirecting a failed login

This ensures that third party logins, whose callback is processed
by the users controller, go to the right place.

Drop duplicate unconfirmed_login definition

This allows third party logins to use the common definition from
the SessionMethods concern which specifies the controller.

Test third party logins to pending/suspended/blocked accounts

Bump eslint from 8.0.1 to 8.1.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.0.1 to 8.1.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.0.1...v8.1.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/3348'

Localisation updates from https://translatewiki.net.

Use em rather than fixed pixels to offset the copyright symbol

Fixes #3302

Also fixes an error where the h5 tag was closed incorrectly.

Merge pull request #3347 from Robbendebiene/patch-3

Make image non-blocking for pointer inputs

Make image non-blocking for pointer inputs

Currently the arm of the planet on https://www.openstreetmap.org/user/new is blocking pointer inputs on about a third of the email input field. This is solved by adding `pointer-events: none;` to the image.

Update bundle

Merge remote-tracking branch 'upstream/pull/3344'

Localisation updates from https://translatewiki.net.

Bump actions/checkout from 2.3.4 to 2.3.5

Bumps [actions/checkout](https://github.com/actions/checkout) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2.3.4...v2.3.5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/3343'

Bump eslint from 8.0.0 to 8.0.1

Bumps [eslint](https://github.com/eslint/eslint) from 8.0.0 to 8.0.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.0.0...v8.0.1)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3341'

Merge remote-tracking branch 'upstream/pull/3340'

Use flexbox instead of floating to position the comment icon

This ensures both components get appropriate padding. Fixes #3305

Specify avatar dimensions in html tags

This prevents reflow when the images are loaded by the browser.

ActiveStorage variants are resized lazily when the image is requested,
so we only know the dimensions if the image was already loaded. This
means that there will be one reflow just after a new avatar is first
viewed.

Update bundle

Merge remote-tracking branch 'upstream/pull/3339'

Bump eslint from 7.32.0 to 8.0.0

Bumps [eslint](https://github.com/eslint/eslint) from 7.32.0 to 8.0.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.32.0...v8.0.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3300'

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3336'

Remove mention of trac in README

We no longer use or refer to trac, which has in the meantime been archived anyway.

Update bundle

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3332'

Merge remote-tracking branch 'upstream/pull/3316'

Fix new rubocop warning

Update bundle

Move the tracepoint coordinate format test to the controller test

This allows us to remove the model method

Refactor tracepoint index to use an xml builder view

This avoids constructing xml by hand in both the controller and
the model, and opens the way for other rendering in future.

The complexity of deciding which point goes where, along with revisiting
previous tracks and tracksegs means that I've broken it down into
two parts - sorting the points into the right trksegs is done first,
before rendering them all as xml. I couldn't find a way to allow
revisiting using the builder.

Merge remote-tracking branch 'upstream/pull/3331'

Bump ansi-regex from 5.0.0 to 5.0.1

Bumps [ansi-regex](https://github.com/chalk/ansi-regex) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/chalk/ansi-regex/releases)
- [Commits](https://github.com/chalk/ansi-regex/compare/v5.0.0...v5.0.1)

---
updated-dependencies:
- dependency-name: ansi-regex
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/3330'

Bump nokogiri from 1.12.4 to 1.12.5

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.12.4 to 1.12.5.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.12.4...v1.12.5)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Update bundle

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3327'

Rename file so that it's included in test runs

Merge remote-tracking branch 'upstream/pull/3297'

Merge remote-tracking branch 'upstream/pull/3324'

Drop customisation for Rails/ContentTag

Merge remote-tracking branch 'upstream/pull/3323'

Remove the ObjectMetadata concern, since it's only used in tests now

Remove unused to_xml and to_xml_node methods from models

Move the xml format test for old nodes to the controller test

This allows us to remove the model method

Use a builder to render changeset downloads

Fix test

Use flexbox to position user thumbnails on the dashboard

This fixes a poor interaction involving lots of margins and the secondary-actions list

Refactor paragraph margin to avoid custom css

Restore the grey border around the user image on the profile page

This approach keeps the look without adding in the margins (and floats)
which are inappropriate for the flex-based layout.

Use an 'inline' dl to unify the appearance of the mapper and admin info details lines

Move the admin actions into line with the other links

This avoids wrapping them under the user profile picture

Merge pull request #179 from tomhughes/secondary-actions

Improve behaviour of secondary action lists when wrapping

Temporary pin on rubocop-rails until next bugfix release

There is a bug in the Rails/ContentTag cop that causes rubocop to crash. The bug has already been fixed and so should be available in the next release.

See https://github.com/rubocop/rubocop-rails/issues/543

Update rubocop todo and fix new warnings

Update bundle

Localisation updates from https://translatewiki.net.

Use autodetection for text files

Merge remote-tracking branch 'upstream/pull/3313'

Merge remote-tracking branch 'upstream/pull/3285'

Merge remote-tracking branch 'upstream/pull/3318'

Merge remote-tracking branch 'upstream/pull/3317'

Added `crossing` as key

Added a couple of keys under `natural` to en.yml

Localisation updates from https://translatewiki.net.

Add Fastly as top three donor

Update en.yml

Updated (simplified) map tile attribution requirement to be the same as for any use of OSM data (based on request to LWG)

Update bundle

Add gitattribute to force lf line endings

Add .editorconfig

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3308'

Bump js-cookie from 3.0.0 to 3.0.1

Bumps [js-cookie](https://github.com/js-cookie/js-cookie) from 3.0.0 to 3.0.1.
- [Release notes](https://github.com/js-cookie/js-cookie/releases)
- [Changelog](https://github.com/js-cookie/js-cookie/blob/master/.release-it.json)
- [Commits](https://github.com/js-cookie/js-cookie/compare/v3.0.0...v3.0.1)

---
updated-dependencies:
- dependency-name: js-cookie
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Update bundle

Localisation updates from https://translatewiki.net.

Check that user email address are only returned with read_email