chore: update eslint, enable more rules and fix their findings (#39438)

Update eslint and its plugins, enable more rules and fix their findings:

1. `unicorn/no-unsafe-string-replacement` found that uploading a file
whose name contains `$&` inserted a broken markdown link, because
`String#replace` expands such patterns in the replacement string
2. `@typescript-eslint/require-await` removes `async` from functions
that never await
3. Plugin rules not covered by a preset are now listed explicitly

---------

Co-authored-by: bircni <bircni@icloud.com>

web_src/js/markup/math.ts

@@ -13,7 +13,7 @@ function targetElement(elCode: Element): {target: Element, displayAsBlock: boole
   };
 }
 
-export async function initMarkupCodeMath(elMarkup: HTMLElement): Promise<void> {
+export function initMarkupCodeMath(elMarkup: HTMLElement): void {
   // .markup code.language-math'
   queryElems(elMarkup, 'code.language-math', async (el) => {
     const [{default: katex}] = await Promise.all([

web_src/js/markup/mermaid.ts

@@ -16,7 +16,7 @@ function initMermaidViewController(viewController: Element, dragElement: SVGSVGE
 
   for (const el of viewController.querySelectorAll('[data-control-action]')) {
     el.addEventListener('click', () => {
-      switch (el.getAttribute('data-control-action')) {
+      switch (el.getAttribute('data-control-action')!) {
         case 'zoom-in':
           scale *= 1.2;
           break;

web_src/js/markup/render-iframe.ts

@@ -42,7 +42,7 @@ function getRealBackgroundColor(el: HTMLElement) {
   return '';
 }
 
-export async function initExternalRenderIframe(iframe: HTMLIFrameElement) {
+export function initExternalRenderIframe(iframe: HTMLIFrameElement) {
   const iframeSrcUrl = iframe.getAttribute('data-src')!;
   if (!iframe.id) iframe.id = generateElemId('gitea-iframe-');