Set secure flag for matomo cookies

Allow matomo cookie timeouts to be configured

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3832'

Bump nokogiri from 1.13.9 to 1.13.10

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.13.9 to 1.13.10.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/main/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.13.9...v1.13.10)

---
updated-dependencies:
- dependency-name: nokogiri
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/3830'

Merge remote-tracking branch 'upstream/pull/3828'

Remove tile_for_point SQL functions

This removes both the pl/pgsql version and the shared library version
of the `tile_for_point` SQL function. This function was only used in some
old migrations, and is not required for production usage.

Removing this function simplifies the installation and configuration for
new developers.

These SQL functions are separate from the `tile_for_point` ruby/C function
which is part of the quad_tile gem. This function is still used when
creating and updating database records.

Fixes #3110.

Remove fallback code for undefined history.pushState()

Update bundle

Localisation updates from https://translatewiki.net.

Only send user IDs to matomo when configured to do so

Merge remote-tracking branch 'upstream/pull/3821'

Merge remote-tracking branch 'upstream/pull/3825'

Merge remote-tracking branch 'upstream/pull/3822'

Merge remote-tracking branch 'upstream/pull/3126'

Bump eslint from 8.28.0 to 8.29.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.28.0 to 8.29.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.28.0...v8.29.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Bump leaflet.locatecontrol from 0.78.0 to 0.79.0

Bumps [leaflet.locatecontrol](https://github.com/domoritz/leaflet-locatecontrol) from 0.78.0 to 0.79.0.
- [Release notes](https://github.com/domoritz/leaflet-locatecontrol/releases)
- [Changelog](https://github.com/domoritz/leaflet-locatecontrol/blob/gh-pages/CHANGELOG.md)
- [Commits](https://github.com/domoritz/leaflet-locatecontrol/compare/v0.78.0...v0.79.0)

---
updated-dependencies:
- dependency-name: leaflet.locatecontrol
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Add more testcases to changesets_controller

Extracted from pull request #1995

Make tooltip tests more robust

Merge remote-tracking branch 'upstream/pull/3688'

Merge remote-tracking branch 'upstream/pull/3820'

Use mail_to help to avoid handcrafting mailto links

This also reworks the user suspended page to avoid having html in
the translation strings.

Update bundle

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Merge pull request #3676 from harry-wood/notes-disappear-time

Display how long until a note will disappear

Update node modules

Merge remote-tracking branch 'upstream/pull/3301'

Fix new rubocop warnings

Update bundle

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3809'

Merge remote-tracking branch 'upstream/pull/3808'

Bump leaflet from 1.9.2 to 1.9.3

Bumps [leaflet](https://github.com/Leaflet/Leaflet) from 1.9.2 to 1.9.3.
- [Release notes](https://github.com/Leaflet/Leaflet/releases)
- [Changelog](https://github.com/Leaflet/Leaflet/blob/main/CHANGELOG.md)
- [Commits](https://github.com/Leaflet/Leaflet/compare/v1.9.2...v1.9.3)

---
updated-dependencies:
- dependency-name: leaflet
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump eslint from 8.27.0 to 8.28.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.27.0 to 8.28.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.27.0...v8.28.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/3805'

Merge remote-tracking branch 'upstream/pull/3804'

Merge remote-tracking branch 'upstream/pull/3803'

Use the mail_to method to construct a mailto link for browse tag values

This is easier than building a mailto link ourselves. Also implement
the missing title tag and write a test for it.

Enable more brakeman checks

These have been refactored already, so no longer need to be skipped.

Localisation updates from https://translatewiki.net.

Create a second title_user translation, to avoid using html_safe

Reconfigure the suspended flash message to avoid html_safe

This also avoids having raw html in the translation strings

Merge remote-tracking branch 'upstream/pull/3798'

Merge remote-tracking branch 'upstream/pull/3797'

Merge remote-tracking branch 'upstream/pull/3799'

Merge remote-tracking branch 'upstream/pull/3800'

Merge pull request #3779 from AntonKhorev/spinner

Replace searching.gif images with Bootstrap spinners

Use rails 7.0 configuration defaults

All the entries in the new framework defaults were enabled a while
ago, apart from the cookies serializer which is already defined in
config/initializers/cookies_serializer.rb

Relax strict version constraint on rails gem

This lets us receive 7.0.x patch releases without having to edit the Gemfile.

Pass original event instad of leaflet event to changeset bbox click simulation

Minor documentation tweaks

Prefer 'you' to 'one' since 'you' is used throughout the documentation and is easier for non-native speakers.

Standardise on openstreetmap-website instead of rails port

Fixes #3796

Merge remote-tracking branch 'upstream/pull/3795'

Fix feature request GitHub issue template

The syntax for the feature request GitHub issue template yaml file was wrong because two elements had the same ids and thus the feature request issue form did not work. This changes one that was the same.

Update bundle

Merge remote-tracking branch 'upstream/pull/3792'

Localisation updates from https://translatewiki.net.

clear default connections when using preauth

Merge remote-tracking branch 'upstream/pull/3791'

Update to iD v2.23.2

Merge remote-tracking branch 'upstream/pull/3789'

Update to iD v2.23.1

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3780'

Merge remote-tracking branch 'upstream/pull/3783'

Update bundle

Merge remote-tracking branch 'upstream/pull/3788'

Bump eslint from 8.26.0 to 8.27.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.26.0 to 8.27.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.26.0...v8.27.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Bump leaflet.locatecontrol from 0.76.1 to 0.78.0

Bumps [leaflet.locatecontrol](https://github.com/domoritz/leaflet-locatecontrol) from 0.76.1 to 0.78.0.
- [Release notes](https://github.com/domoritz/leaflet-locatecontrol/releases)
- [Changelog](https://github.com/domoritz/leaflet-locatecontrol/blob/gh-pages/CHANGELOG.md)
- [Commits](https://github.com/domoritz/leaflet-locatecontrol/compare/v0.76.1...v0.78.0)

---
updated-dependencies:
- dependency-name: leaflet.locatecontrol
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Use Pathname.glob to fetch the files

Validate URLs against supply-chain attacks

Unfortunately validates_url gem doesn't support mailto or xmpp urls,
so we need to write our own validation.

Merge remote-tracking branch 'upstream/pull/3781'

Remove outdated comments

The action no longer deals with sending, and there's no display_name
param in this bit of code so it's a bit confusing.

Enable the ActionOrder cop for remaining controllers

Where actions were reordered, the rails standard actions were
also moved to the top of each controller.

Fix new rubocop warnings

Update bundle

Remove query result geometry when unloading the page

Merge remote-tracking branch 'upstream/pull/3778'

Replace spinners in javascript

Replace spinners in html.erb templates

Add aria-label to close buttons

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3776'

Remove query spinner show delay because the spinner is not hidden

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3770'

Merge remote-tracking branch 'upstream/pull/3769'

Merge remote-tracking branch 'upstream/pull/3771'

Add guidance on making pull requests easier to review

Use close button instead of geolink in sidebar content

Merge changeset <ol>s on Load more

Merge remote-tracking branch 'upstream/pull/3768'

Merge remote-tracking branch 'upstream/pull/3765'

Fix new rubocop warnings

Update bundle