chore: update eslint, enable more rules and fix their findings (#39438)

Update eslint and its plugins, enable more rules and fix their findings:

1. `unicorn/no-unsafe-string-replacement` found that uploading a file
whose name contains `$&` inserted a broken markdown link, because
`String#replace` expands such patterns in the replacement string
2. `@typescript-eslint/require-await` removes `async` from functions
that never await
3. Plugin rules not covered by a preset are now listed explicitly

---------

Co-authored-by: bircni <bircni@icloud.com>

web_src/js/features/captcha.ts

@@ -12,7 +12,7 @@ export async function initCaptcha() {
     theme: isDark ? 'dark' : 'light',
   };
 
-  switch (captchaEl.getAttribute('data-captcha-type')) {
+  switch (captchaEl.getAttribute('data-captcha-type') ?? '') {
     case 'g-recaptcha': {
       if (window.grecaptcha) {
         window.grecaptcha.ready(() => {