chore: update eslint, enable more rules and fix their findings (#39438)

Update eslint and its plugins, enable more rules and fix their findings:

1. `unicorn/no-unsafe-string-replacement` found that uploading a file
whose name contains `$&` inserted a broken markdown link, because
`String#replace` expands such patterns in the replacement string
2. `@typescript-eslint/require-await` removes `async` from functions
that never await
3. Plugin rules not covered by a preset are now listed explicitly

---------

Co-authored-by: bircni <bircni@icloud.com>

web_src/js/swagger.ts

@@ -6,7 +6,7 @@ async function initGiteaAPIViewer() {
   const url = elSwaggerUi.getAttribute('data-source')!;
   const res = await fetch(url); // eslint-disable-line no-restricted-globals -- standalone entry, it must not pull in main site modules
   // HINT: SWAGGER-CSS-IMPORT: this is used in the standalone page which already has the related CSS imported by `<link>`
-  await initSwaggerUI(elSwaggerUi, {specText: await res.text()});
+  initSwaggerUI(elSwaggerUi, {specText: await res.text()});
 }
 
 initGiteaAPIViewer();