chore: enable forcetypeassert linter, fix issues (#38804)

Enable [`forcetypeassert`](https://github.com/gostaticanalysis/forcetypeassert)
linter to prevent unchecked type assertions. ~650 issues fixed, most
fixes were clean, some use `setting.PanicInDevOrTesting`.

The only behaviour changes are where code would previously send a 500 error
or panic, a 4xx error is now emitted.

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

routers/common/auth.go

@@ -24,7 +24,7 @@ func AuthShared(ctx *context.Base, sessionStore auth_service.SessionStore, authM
 		if ctx.Locale.Language() != ar.Doer.Language {
 			ctx.Locale = middleware.Locale(ctx.Resp, ctx.Req)
 		}
-		ar.IsBasicAuth = ctx.Data["AuthedMethod"].(string) == auth_service.BasicMethodName
+		ar.IsBasicAuth = ctx.Data["AuthedMethod"] == auth_service.BasicMethodName
 
 		ctx.Data["IsSigned"] = true
 		ctx.Data[middleware.ContextDataKeySignedUser] = ar.Doer

routers/common/middleware.go

@@ -95,7 +95,7 @@ func RequestContextHandler() func(h http.Handler) http.Handler {
 				// The "req" might have changed due to the new "req.WithContext" calls
 				// For example: in NewBaseContext, a new "req" with context is created, and the multipart-form is parsed there.
 				// So we always use the latest "req" from the data store.
-				ctxReq := ds.GetContextValue(httplib.RequestContextKey).(*http.Request)
+				ctxReq := ds.GetContextValue(httplib.RequestContextKey).(*http.Request) //nolint:forcetypeassert // must be valid
 				if ctxReq.MultipartForm != nil {
 					_ = ctxReq.MultipartForm.RemoveAll() // remove the temp files buffered to tmp directory
 				}