chore: update eslint, enable more rules and fix their findings (#39438)

Update eslint and its plugins, enable more rules and fix their findings:

1. `unicorn/no-unsafe-string-replacement` found that uploading a file
whose name contains `$&` inserted a broken markdown link, because
`String#replace` expands such patterns in the replacement string
2. `@typescript-eslint/require-await` removes `async` from functions
that never await
3. Plugin rules not covered by a preset are now listed explicitly

---------

Co-authored-by: bircni <bircni@icloud.com>

web_src/js/features/repo-common.ts

@@ -49,7 +49,7 @@ export function substituteRepoOpenWithUrl(tmpl: string, url: string): string {
   if (pos === -1) return tmpl;
   const posQuestionMark = tmpl.indexOf('?');
   const needEncode = posQuestionMark >= 0 && posQuestionMark < pos;
-  return tmpl.replace('{url}', needEncode ? encodeURIComponent(url) : url);
+  return tmpl.replace('{url}', () => needEncode ? encodeURIComponent(url) : url);
 }
 
 function initRepoCloneButtonsCombo(parent: Element) {