Validate any origin passed the auth failure callback

Fixes #3375

Improve fallback behaviour for unsafe referer redirects

Handle authentication failure callbacks with no message

Handle exceptions rendering flash messages

Make safe_referer handle invalid URIs

Merge remote-tracking branch 'upstream/pull/3373'

Bump eslint from 8.2.0 to 8.3.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.2.0 to 8.3.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.2.0...v8.3.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Disable oxipng in image_optim config

Update bundle

Localisation updates from https://translatewiki.net.

Drop unused browser feature predicates

Drop es5 polyfill

Drop use of html5shiv

Fixes #3367

Localisation updates from https://translatewiki.net.

Fix boot warnings for autoloaded constants in initializers

Send plain errors for non HTML resources

Without this we throw a second error when we can't find a view
of the correct format and issue a 500 response.

Fix new rubocop warnings

Update bundle

Merge remote-tracking branch 'upstream/pull/3353'

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3365'

Merge remote-tracking branch 'upstream/pull/3364'

Convert remaining heading titles to use h1

This makes them consistent with all the other pages that use h1
in the `content_for :heading` sections

Remove the userinformation ids from headings

The style rule was removed in 3f8cf322723750aa4c8d062d4a727f9107ceccb4
and they were otherwise only used in the tests.

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3363'

Merge remote-tracking branch 'upstream/pull/3362'

Merge remote-tracking branch 'upstream/pull/3361'

Simplify user_image and user_thumbnail css

Now that all uses of the images and thumbnails have been migrated
to flex grids, we can remove the margin and padding from the original
css classes and revert to using them.

fixup popup

Use grid for dashboard map popups

Use flex grid for issue reports and comments

Use flex grid for diary index headings

Rework diary entries to use grid when a heading thumbnail is shown

This happens on the index page, but not individual show pages. I've
reversed the if condition to avoid having an else on a negative
condition.

Use grid for diary entry heading layout

This brings it into line with the user profile, which has a similar heading

Rework diary comments to use flex grid rather than floats and margins

Fix erblint errors from the Rails/ContentTag cop

Drop rubocop-rails version lock

Update bundle

Merge remote-tracking branch 'upstream/pull/3359'

Bump eslint from 8.1.0 to 8.2.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.1.0 to 8.2.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.1.0...v8.2.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Switch to Argon2 for password hashing

Remove custom css overrides for the users list

The margins on the buttons aren't needed since the table has a bottom
margin, and the button class has never been applied since it was
incorrectly in the id field. The table row override had no effect since
the cells have their own vertical-alignment set.

Remove the paragraph margin overrides for the users list

Add button classes for users list action buttons

Remove the contact-activity class

The margin-top is better replaced with a bottom margin on the
preceding element, and the width is unnecessary in the grid layout.

Remove custom margins on sidebar headings

Margin-top in particular is best avoided. The removal of some top
margins required a few corresponding changes to add bottom margins
to other features, mostly done by converting bare text strings to
live within paragraphs.

Merge remote-tracking branch 'upstream/pull/3357'

Merge remote-tracking branch 'upstream/pull/3356'

Bump actions/checkout from 2.3.5 to 2.4.0

Bumps [actions/checkout](https://github.com/actions/checkout) from 2.3.5 to 2.4.0.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2.3.5...v2.4.0)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Bump leaflet.locatecontrol from 0.74.0 to 0.74.1

Bumps [leaflet.locatecontrol](https://github.com/domoritz/leaflet-locatecontrol) from 0.74.0 to 0.74.1.
- [Release notes](https://github.com/domoritz/leaflet-locatecontrol/releases)
- [Changelog](https://github.com/domoritz/leaflet-locatecontrol/blob/gh-pages/CHANGELOG.md)
- [Commits](https://github.com/domoritz/leaflet-locatecontrol/compare/v0.74.0...v0.74.1)

---
updated-dependencies:
- dependency-name: leaflet.locatecontrol
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Update bundle

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3354'

Localisation updates from https://translatewiki.net.

Update to iD v2.20.2

Merge remote-tracking branch 'upstream/pull/3349'

Update bundle

Serve an updated TOTP token with the browse query response

Localisation updates from https://translatewiki.net.

Specify the controller when redirecting a failed login

This ensures that third party logins, whose callback is processed
by the users controller, go to the right place.

Drop duplicate unconfirmed_login definition

This allows third party logins to use the common definition from
the SessionMethods concern which specifies the controller.

Test third party logins to pending/suspended/blocked accounts

Bump eslint from 8.0.1 to 8.1.0

Bumps [eslint](https://github.com/eslint/eslint) from 8.0.1 to 8.1.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.0.1...v8.1.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/3348'

Localisation updates from https://translatewiki.net.

Use em rather than fixed pixels to offset the copyright symbol

Fixes #3302

Also fixes an error where the h5 tag was closed incorrectly.

Merge pull request #3347 from Robbendebiene/patch-3

Make image non-blocking for pointer inputs

Make image non-blocking for pointer inputs

Currently the arm of the planet on https://www.openstreetmap.org/user/new is blocking pointer inputs on about a third of the email input field. This is solved by adding `pointer-events: none;` to the image.

Update bundle

Merge remote-tracking branch 'upstream/pull/3344'

Localisation updates from https://translatewiki.net.

Bump actions/checkout from 2.3.4 to 2.3.5

Bumps [actions/checkout](https://github.com/actions/checkout) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/v2.3.4...v2.3.5)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Merge remote-tracking branch 'upstream/pull/3343'

Bump eslint from 8.0.0 to 8.0.1

Bumps [eslint](https://github.com/eslint/eslint) from 8.0.0 to 8.0.1.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v8.0.0...v8.0.1)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3341'

Merge remote-tracking branch 'upstream/pull/3340'

Use flexbox instead of floating to position the comment icon

This ensures both components get appropriate padding. Fixes #3305

Specify avatar dimensions in html tags

This prevents reflow when the images are loaded by the browser.

ActiveStorage variants are resized lazily when the image is requested,
so we only know the dimensions if the image was already loaded. This
means that there will be one reflow just after a new avatar is first
viewed.

Update bundle

Merge remote-tracking branch 'upstream/pull/3339'

Bump eslint from 7.32.0 to 8.0.0

Bumps [eslint](https://github.com/eslint/eslint) from 7.32.0 to 8.0.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/eslint/eslint/compare/v7.32.0...v8.0.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3300'

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3336'

Remove mention of trac in README

We no longer use or refer to trac, which has in the meantime been archived anyway.

Update bundle

Localisation updates from https://translatewiki.net.

Localisation updates from https://translatewiki.net.

Merge remote-tracking branch 'upstream/pull/3332'

Merge remote-tracking branch 'upstream/pull/3316'

Fix new rubocop warning

Update bundle

Move the tracepoint coordinate format test to the controller test

This allows us to remove the model method

Refactor tracepoint index to use an xml builder view

This avoids constructing xml by hand in both the controller and
the model, and opens the way for other rendering in future.

The complexity of deciding which point goes where, along with revisiting
previous tracks and tracksegs means that I've broken it down into
two parts - sorting the points into the right trksegs is done first,
before rendering them all as xml. I couldn't find a way to allow
revisiting using the builder.

Merge remote-tracking branch 'upstream/pull/3331'