chore: update eslint, enable more rules and fix their findings (#39438)

Update eslint and its plugins, enable more rules and fix their findings:

1. `unicorn/no-unsafe-string-replacement` found that uploading a file
whose name contains `$&` inserted a broken markdown link, because
`String#replace` expands such patterns in the replacement string
2. `@typescript-eslint/require-await` removes `async` from functions
that never await
3. Plugin rules not covered by a preset are now listed explicitly

---------

Co-authored-by: bircni <bircni@icloud.com>

web_src/js/modules/search.ts

@@ -74,7 +74,7 @@ export function attachSearchBox<T = unknown>(container: HTMLElement, url: string
     if (query.length < minCharacters) return hide();
     const ctrl = (fetchController = new AbortController());
     try {
-      const response = await GET(url.replaceAll('{query}', urlQueryEscape(query)), {signal: ctrl.signal});
+      const response = await GET(url.replaceAll('{query}', () => urlQueryEscape(query)), {signal: ctrl.signal});
       if (!response.ok) return hide();
       const results = parse(await response.json(), query);
       // only render if the fetch wasn't aborted (e.g. by hide()) and the input still matches