Merge remote-tracking branch 'upstream/pull/4228'

Bump actions/checkout from 3 to 4

Bumps [actions/checkout](https://github.com/actions/checkout) from 3 to 4.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v3...v4)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4223'

Merge remote-tracking branch 'upstream/pull/4222'

Merge remote-tracking branch 'upstream/pull/4221'

Remove unused partial _user.atom.builder

Add bbox parameter to notes search api

Check required bbox parameter presence outside of BoundingBox class

Drop non-functional check for nil email

Merge remote-tracking branch 'upstream/pull/4216'

Merge remote-tracking branch 'upstream/pull/4214'

Add some additional preloads to notes#feed

Move email-related methods to mixin

Add notes feed description for unspecified area

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4212'

Merge pull request #4211 from tomhughes/changeset-comment-cleanup

Address review comments for changeset comment limiting

Bump facebook API version

Improve testing of changeset comment rate limits

Move changeset comment rate limit check to a predicate method

Improve naming of changeset comment rate limit settings

Use bootstrap badges to implement count-number badges

This leaves bootstrap to take care of most aspects, while retaining
the current colours and font weights.

Merge remote-tracking branch 'upstream/pull/4210'

Merge remote-tracking branch 'upstream/pull/4209'

Use Activerecord '#or' method for queries

That let's us use relation names (like `sender`) and avoid dealing
directly with ids.

Use trace instead of gpx_id in queries

This makes the queries easier to read.

Avoid using _id in queries

This makes the queries shorter and easier to read.

Merge pull request #4193 from AntonKhorev/lookup-friend

Lookup friend user before make/remove friend action

Merge pull request #4197 from AntonKhorev/user-resources

Move user lookup/error methods from app controller to concerns

Merge pull request #4202 from tomhughes/changeset-comment-limit

Add rate limiting for changeset comments

Update bundle

Merge remote-tracking branch 'upstream/pull/4208'

Bump osm-community-index from 5.5.5 to 5.6.0

Bumps [osm-community-index](https://github.com/osmlab/osm-community-index) from 5.5.5 to 5.6.0.
- [Release notes](https://github.com/osmlab/osm-community-index/releases)
- [Changelog](https://github.com/osmlab/osm-community-index/blob/main/CHANGELOG.md)
- [Commits](https://github.com/osmlab/osm-community-index/compare/v5.5.5...v5.6.0)

---
updated-dependencies:
- dependency-name: osm-community-index
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4198'

Restore ordering of results from the users#index API call

Merge remote-tracking branch 'upstream/pull/4203'

Add checks to ensure that the response is empty

Merge remote-tracking branch 'upstream/pull/4204'

Sort users by their ids

Change tests to expect a successful (empty) response even if the user is not visible anymore

Bump eslint from 8.47.0 to 8.48.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.47.0 to 8.48.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.47.0...v8.48.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Use where instead of find to prevent 404

Add rate limiting for changeset comments

Fixes #4196

Test that suspended and deleted users can't use OAuth tokens

Logout while testing OAuth 1 token usage

This ensures we're not accidentally inheriting any session permissions.

Separate authenticating user from application owner in OAuth 1 tests

Localisation updates from https://translatewiki.net.

Make the TOTP cookie httponly

Update to rails 7.0.7.2

Update bundle

Add support for rate limiting signup requests

Lookup friend user before make/remove friend action

Lookup user before action in user's notes list

Render unknown user with concerns code in notes controller

Move user lookup and error render to concerns

Merge remote-tracking branch 'upstream/pull/4190'

Merge remote-tracking branch 'upstream/pull/4169'

Change provider name to "microsoft"

Add migration script

Update tests for microsoft_graph endpoints

Respond with plaintext when user not found in changeset query

The response used to be of type xml with empty body, which is not valid xml.

Merge remote-tracking branch 'upstream/pull/4187'

Merge remote-tracking branch 'upstream/pull/4186'

Replace links to donate.osm.org with supporting.osm.org

Expose note query limit values in api capabilities

Add missing changeset query limit capabilities test

Use max note query limit setting in tests

Move note query limit values to settings

Bump puma from 5.6.6 to 5.6.7

Bumps [puma](https://github.com/puma/puma) from 5.6.6 to 5.6.7.
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/master/History.md)
- [Commits](https://github.com/puma/puma/compare/v5.6.6...v5.6.7)

---
updated-dependencies:
- dependency-name: puma
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/4185'

Make the versions call default to XML

Merge remote-tracking branch 'upstream/pull/4182'

Merge remote-tracking branch 'upstream/pull/4180'

Merge remote-tracking branch 'upstream/pull/4181'

Add 'User' to selectable types in issues search for moderators

Reported users are either directly assigned to moderators or ofter reassigned to them.

Add JSON output to /api/versions

Bump osm-community-index from 5.5.4 to 5.5.5

Bumps [osm-community-index](https://github.com/osmlab/osm-community-index) from 5.5.4 to 5.5.5.
- [Release notes](https://github.com/osmlab/osm-community-index/releases)
- [Changelog](https://github.com/osmlab/osm-community-index/blob/main/CHANGELOG.md)
- [Commits](https://github.com/osmlab/osm-community-index/compare/v5.5.4...v5.5.5)

---
updated-dependencies:
- dependency-name: osm-community-index
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Update to iD v2.27.1

Merge remote-tracking branch 'upstream/pull/4171'

Merge remote-tracking branch 'upstream/pull/4179'

Merge remote-tracking branch 'upstream/pull/4178'

Add color keys to note tables

Remove right leaflet toolbar position override

Has no effect, doesn't take rtl into account.
Was added in https://github.com/openstreetmap/openstreetmap-website/commit/537d72b0f66562475808249a1a2ef3223df5dd52#diff-fe520170ce0c939dc1e59f3395a360a1866b4da19b474c9f0b35112f72e952d8R117

Replace references to windowslive with microsoft_graph

Use omniauth-microsoft_graph instead of omniauth-windowslive

Omniauth-microsoft_graph correctly populates 'email' and 'name' fields used by OpenStreetMap.
It also  uses updated endpoints for Microsoft identity provider.

Use email address returned by microsoft_graph provider as a verified address.

Upgrading exisiting users from windowslive to microsoft_graph:
 - upon next login existing `windowslive` users will have to authorizei
   OpenStreetMap application to "Read Your Profile," required for proper reading
   of display name field.

The name of the identity provider in OSM is kept to 'windowslive':
 - the entries in users table with `provider == 'windowslive'`
   can be reused for microsoft_graph provider, since
   the uid field is preserved. Users will not need to repeat the sign up process.
 - OAuth2 callback is still `/auth/windowslive`, no updates to Microsoft Identity Provider portal
   App registration are necessary.

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/4174'

Update to iD v2.27.0

Merge pull request #4133 from AntonKhorev/flex-leaflet-controls

Use multiple columns for map controls if they don't fit vertically

Merge pull request #4150 from AntonKhorev/note-table-bootstrap-highlight

Use Bootstrap highlight class in note tables

Merge pull request #4156 from AntonKhorev/bootstrap-code-direction-fix

Don't do direction override from Bootstrap reboot of <code>

Merge pull request #4148 from tomhughes/avatar-image

Use correct extension and type for avatar images attached to mails

Merge pull request #4173 from AntonKhorev/comments

Small changes of diary comments

Merge pull request #4172 from tomhughes/user-predicates

Fix predicate method names in the user model

Replace top margin on comments with bottom padding on diary posts

Remove empty comments anchor

Fix predicate method names in the user model

Fix new rubocop warnings