Invalidate existing sessions when changing email or password

As we don't have any way to actually find the active sessions for
an account we instead store a fingerprint in the session, and refuse
to use any session with a different fingerprint.

Delete any outstanding tokens when a user changes their email

This ensures that any tokens previously sent to the old email address
can no longer be used if somebody were able to access that address.

Merge remote-tracking branch 'upstream/pull/2859'

Merge remote-tracking branch 'upstream/pull/2858'

Bump puma from 4.3.6 to 5.0.2

Bumps [puma](https://github.com/puma/puma) from 4.3.6 to 5.0.2.
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/master/History.md)
- [Commits](https://github.com/puma/puma/compare/v4.3.6...v5.0.2)

Signed-off-by: dependabot[bot] <support@github.com>

Bump brakeman from 4.9.1 to 4.10.0

Bumps [brakeman](https://github.com/presidentbeef/brakeman) from 4.9.1 to 4.10.0.
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](https://github.com/presidentbeef/brakeman/compare/v4.9.1...v4.10.0)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/2857'

Merge remote-tracking branch 'upstream/pull/2856'

Merge remote-tracking branch 'upstream/pull/2855'

Merge remote-tracking branch 'upstream/pull/2854'

Bump eslint from 7.9.0 to 7.10.0

Bumps [eslint](https://github.com/eslint/eslint) from 7.9.0 to 7.10.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.9.0...v7.10.0)

Signed-off-by: dependabot[bot] <support@github.com>

Bump rubocop from 0.91.1 to 0.92.0

Bumps [rubocop](https://github.com/rubocop-hq/rubocop) from 0.91.1 to 0.92.0.
- [Release notes](https://github.com/rubocop-hq/rubocop/releases)
- [Changelog](https://github.com/rubocop-hq/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop-hq/rubocop/compare/v0.91.1...v0.92.0)

Signed-off-by: dependabot[bot] <support@github.com>

Bump aws-sdk-s3 from 1.81.0 to 1.81.1

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.81.0 to 1.81.1.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Bump dalli from 2.7.10 to 2.7.11

Bumps [dalli](https://github.com/petergoldstein/dalli) from 2.7.10 to 2.7.11.
- [Release notes](https://github.com/petergoldstein/dalli/releases)
- [Changelog](https://github.com/petergoldstein/dalli/blob/master/History.md)
- [Commits](https://github.com/petergoldstein/dalli/compare/v2.7.10...v2.7.11)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/2848'

Merge remote-tracking branch 'upstream/pull/2847'

Bump browser from 4.2.0 to 5.0.0

Bumps [browser](https://github.com/fnando/browser) from 4.2.0 to 5.0.0.
- [Release notes](https://github.com/fnando/browser/releases)
- [Changelog](https://github.com/fnando/browser/blob/main/CHANGELOG.md)
- [Commits](https://github.com/fnando/browser/compare/v4.2.0...v5.0.0)

Signed-off-by: dependabot[bot] <support@github.com>

Bump rubocop from 0.91.0 to 0.91.1

Bumps [rubocop](https://github.com/rubocop-hq/rubocop) from 0.91.0 to 0.91.1.
- [Release notes](https://github.com/rubocop-hq/rubocop/releases)
- [Changelog](https://github.com/rubocop-hq/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop-hq/rubocop/compare/v0.91.0...v0.91.1)

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/2846'

Localisation updates from https://translatewiki.net.

Bump rubocop-performance from 1.8.0 to 1.8.1

Bumps [rubocop-performance](https://github.com/rubocop-hq/rubocop-performance) from 1.8.0 to 1.8.1.
- [Release notes](https://github.com/rubocop-hq/rubocop-performance/releases)
- [Changelog](https://github.com/rubocop-hq/rubocop-performance/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop-hq/rubocop-performance/compare/v1.8.0...v1.8.1)

Signed-off-by: dependabot[bot] <support@github.com>

API User details: format tweaks

- _show_ to return single user only
- remove nesting for languages

Merge remote-tracking branch 'upstream/pull/2844'

Merge remote-tracking branch 'upstream/pull/2842'

Bump better_errors from 2.8.0 to 2.8.1

Bumps [better_errors](https://github.com/BetterErrors/better_errors) from 2.8.0 to 2.8.1.
- [Release notes](https://github.com/BetterErrors/better_errors/releases)
- [Commits](https://github.com/BetterErrors/better_errors/compare/v2.8.0...v2.8.1)

Signed-off-by: dependabot[bot] <support@github.com>

Bump autoprefixer-rails from 10.0.0 to 10.0.0.2

Bumps [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) from 10.0.0 to 10.0.0.2.
- [Release notes](https://github.com/ai/autoprefixer-rails/releases)
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ai/autoprefixer-rails/compare/10.0.0...10.0.0.2)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Json user details: unit tests

Fix unit test, assume application/xml instead of text/xml

Style changeset descriptions with italics on browse pages

Alternative to #580

This reworks changeset descriptions to use italics instead of header
elements, in order to make them more like quotes.

Care has been taken to make sure that there is still a header element
as the first element of the common details partial, in order to make
the history pages look right (where the partial appears multiple times).

Fix erblint warnings

Merge remote-tracking branch 'upstream/pull/2837'

Show linked features as collapsable detail panels on feature browse pages

Fixes #2823

The panels are collapsed by default, when there is a long list of features, but
open on short lists to save on clicks. 10 items is arbitrary but seemed reasonable.

Merge pull request #2809 from tomhughes/bootstrap

Convert some more forms to use bootstrap

Fix new rubocop warnings

Merge remote-tracking branch 'upstream/pull/2834'

Merge remote-tracking branch 'upstream/pull/2833'

Merge remote-tracking branch 'upstream/pull/2832'

Merge remote-tracking branch 'upstream/pull/2831'

Merge remote-tracking branch 'upstream/pull/2830'

Bump better_errors from 2.7.1 to 2.8.0

Bumps [better_errors](https://github.com/BetterErrors/better_errors) from 2.7.1 to 2.8.0.
- [Release notes](https://github.com/BetterErrors/better_errors/releases)
- [Commits](https://github.com/BetterErrors/better_errors/compare/v2.7.1...v2.8.0)

Signed-off-by: dependabot[bot] <support@github.com>

Bump rubocop from 0.90.0 to 0.91.0

Bumps [rubocop](https://github.com/rubocop-hq/rubocop) from 0.90.0 to 0.91.0.
- [Release notes](https://github.com/rubocop-hq/rubocop/releases)
- [Changelog](https://github.com/rubocop-hq/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop-hq/rubocop/compare/v0.90.0...v0.91.0)

Signed-off-by: dependabot[bot] <support@github.com>

Bump autoprefixer-rails from 9.8.6.3 to 10.0.0

Bumps [autoprefixer-rails](https://github.com/ai/autoprefixer-rails) from 9.8.6.3 to 10.0.0.
- [Release notes](https://github.com/ai/autoprefixer-rails/releases)
- [Changelog](https://github.com/ai/autoprefixer-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ai/autoprefixer-rails/compare/9.8.6.3...10.0.0)

Signed-off-by: dependabot[bot] <support@github.com>

Bump aws-sdk-s3 from 1.80.0 to 1.81.0

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.80.0 to 1.81.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Bump rubocop-rails from 2.8.0 to 2.8.1

Bumps [rubocop-rails](https://github.com/rubocop-hq/rubocop-rails) from 2.8.0 to 2.8.1.
- [Release notes](https://github.com/rubocop-hq/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop-hq/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop-hq/rubocop-rails/compare/v2.8.0...v2.8.1)

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/2828'

Merge remote-tracking branch 'upstream/pull/2826'

Merge remote-tracking branch 'upstream/pull/2825'

Bump webmock from 3.8.3 to 3.9.1

Bumps [webmock](https://github.com/bblimke/webmock) from 3.8.3 to 3.9.1.
- [Release notes](https://github.com/bblimke/webmock/releases)
- [Changelog](https://github.com/bblimke/webmock/blob/master/CHANGELOG.md)
- [Commits](https://github.com/bblimke/webmock/compare/v3.8.3...v3.9.1)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Bump eslint from 7.8.1 to 7.9.0

Bumps [eslint](https://github.com/eslint/eslint) from 7.8.1 to 7.9.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.8.1...v7.9.0)

Signed-off-by: dependabot[bot] <support@github.com>

Bump jbuilder from 2.10.0 to 2.10.1

Bumps [jbuilder](https://github.com/rails/jbuilder) from 2.10.0 to 2.10.1.
- [Release notes](https://github.com/rails/jbuilder/releases)
- [Changelog](https://github.com/rails/jbuilder/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rails/jbuilder/compare/v2.10.0...v2.10.1)

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/2824'

Bump aws-sdk-s3 from 1.79.1 to 1.80.0

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.79.1 to 1.80.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/2822'

Bump rails from 6.0.3.2 to 6.0.3.3

Bumps [rails](https://github.com/rails/rails) from 6.0.3.2 to 6.0.3.3.
- [Release notes](https://github.com/rails/rails/releases)
- [Commits](https://github.com/rails/rails/compare/v6.0.3.2...v6.0.3.3)

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/2821'

Update to iD v2.18.5

Localisation updates from https://translatewiki.net.

Fix new rubocop warnings

Merge remote-tracking branch 'upstream/pull/2818'

Merge remote-tracking branch 'upstream/pull/2817'

Merge remote-tracking branch 'upstream/pull/2816'

Merge remote-tracking branch 'upstream/pull/2815'

Bump rubocop-performance from 1.7.1 to 1.8.0

Bumps [rubocop-performance](https://github.com/rubocop-hq/rubocop-performance) from 1.7.1 to 1.8.0.
- [Release notes](https://github.com/rubocop-hq/rubocop-performance/releases)
- [Changelog](https://github.com/rubocop-hq/rubocop-performance/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop-hq/rubocop-performance/compare/v1.7.1...v1.8.0)

Signed-off-by: dependabot[bot] <support@github.com>

Bump brakeman from 4.9.0 to 4.9.1

Bumps [brakeman](https://github.com/presidentbeef/brakeman) from 4.9.0 to 4.9.1.
- [Release notes](https://github.com/presidentbeef/brakeman/releases)
- [Changelog](https://github.com/presidentbeef/brakeman/blob/main/CHANGES.md)
- [Commits](https://github.com/presidentbeef/brakeman/compare/v4.9.0...v4.9.1)

Signed-off-by: dependabot[bot] <support@github.com>

Bump puma from 4.3.5 to 4.3.6

Bumps [puma](https://github.com/puma/puma) from 4.3.5 to 4.3.6.
- [Release notes](https://github.com/puma/puma/releases)
- [Changelog](https://github.com/puma/puma/blob/master/History.md)
- [Commits](https://github.com/puma/puma/compare/v4.3.5...v4.3.6)

Signed-off-by: dependabot[bot] <support@github.com>

Bump rubocop-rails from 2.7.1 to 2.8.0

Bumps [rubocop-rails](https://github.com/rubocop-hq/rubocop-rails) from 2.7.1 to 2.8.0.
- [Release notes](https://github.com/rubocop-hq/rubocop-rails/releases)
- [Changelog](https://github.com/rubocop-hq/rubocop-rails/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop-hq/rubocop-rails/compare/v2.7.1...v2.8.0)

Signed-off-by: dependabot[bot] <support@github.com>

API User details JSON format

Merge remote-tracking branch 'upstream/pull/2810'

Bump leaflet from 1.6.0 to 1.7.1

Bumps [leaflet](https://github.com/Leaflet/Leaflet) from 1.6.0 to 1.7.1.
- [Release notes](https://github.com/Leaflet/Leaflet/releases)
- [Changelog](https://github.com/Leaflet/Leaflet/blob/master/CHANGELOG.md)
- [Commits](https://github.com/Leaflet/Leaflet/compare/v1.6.0...v1.7.1)

Signed-off-by: dependabot[bot] <support@github.com>

Convert oauth authorization form to use bootstrap

Convert password reset forms to use bootstrap

Convert logout form to use bootstrap

Convert user confirmation forms to use bootstrap

Convert make/remove friend forms to use bootstrap

Localisation updates from https://translatewiki.net.

Fix rubocop Style/SoleNestedConditional warnings

Fix rubocop Style/CombinableLoops warnings

Merge remote-tracking branch 'upstream/pull/2806'

Merge remote-tracking branch 'upstream/pull/2805'

Handle new rubocop warnings

Merge remote-tracking branch 'upstream/pull/2804'

Bump eslint from 7.7.0 to 7.8.1

Bumps [eslint](https://github.com/eslint/eslint) from 7.7.0 to 7.8.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.7.0...v7.8.1)

Signed-off-by: dependabot[bot] <support@github.com>

Bump minitest from 5.14.1 to 5.14.2

Bumps [minitest](https://github.com/seattlerb/minitest) from 5.14.1 to 5.14.2.
- [Release notes](https://github.com/seattlerb/minitest/releases)
- [Changelog](https://github.com/seattlerb/minitest/blob/master/History.rdoc)
- [Commits](https://github.com/seattlerb/minitest/compare/v5.14.1...v5.14.2)

Signed-off-by: dependabot[bot] <support@github.com>

Bump rubocop from 0.89.1 to 0.90.0

Bumps [rubocop](https://github.com/rubocop-hq/rubocop) from 0.89.1 to 0.90.0.
- [Release notes](https://github.com/rubocop-hq/rubocop/releases)
- [Changelog](https://github.com/rubocop-hq/rubocop/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rubocop-hq/rubocop/compare/v0.89.1...v0.90.0)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/2802'

Bump omniauth-facebook from 6.0.0 to 7.0.0

Bumps [omniauth-facebook](https://github.com/mkdynamic/omniauth-facebook) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/mkdynamic/omniauth-facebook/releases)
- [Changelog](https://github.com/simi/omniauth-facebook/blob/master/CHANGELOG.md)
- [Commits](https://github.com/mkdynamic/omniauth-facebook/compare/v6.0.0...v7.0.0)

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/2797'

Make embed.js depend on the settings

Bump aws-sdk-s3 from 1.79.0 to 1.79.1

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.79.0 to 1.79.1.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/2794'

Bump aws-sdk-s3 from 1.78.0 to 1.79.0

Bumps [aws-sdk-s3](https://github.com/aws/aws-sdk-ruby) from 1.78.0 to 1.79.0.
- [Release notes](https://github.com/aws/aws-sdk-ruby/releases)
- [Changelog](https://github.com/aws/aws-sdk-ruby/blob/master/gems/aws-sdk-s3/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-ruby/commits)

Signed-off-by: dependabot[bot] <support@github.com>

Attempt to modernise vagrant configuration

Merge remote-tracking branch 'upstream/pull/2792'