chore: update eslint, enable more rules and fix their findings (#39438)

Update eslint and its plugins, enable more rules and fix their findings:

1. `unicorn/no-unsafe-string-replacement` found that uploading a file
whose name contains `$&` inserted a broken markdown link, because
`String#replace` expands such patterns in the replacement string
2. `@typescript-eslint/require-await` removes `async` from functions
that never await
3. Plugin rules not covered by a preset are now listed explicitly

---------

Co-authored-by: bircni <bircni@icloud.com>

web_src/js/features/repo-commit.ts

@@ -3,7 +3,7 @@ import {toggleElem} from '../utils/dom.ts';
 import {registerGlobalEventFunc, registerGlobalInitFunc} from '../modules/observer.ts';
 
 export function initRepoEllipsisButton() {
-  registerGlobalEventFunc('click', 'onRepoEllipsisButtonClick', async (el: HTMLInputElement, e: Event) => {
+  registerGlobalEventFunc('click', 'onRepoEllipsisButtonClick', (el: HTMLInputElement, e: Event) => {
     e.preventDefault();
     const expanded = el.getAttribute('aria-expanded') === 'true';
     toggleElem(el.parentElement!.querySelector('.commit-body')!);