chore: update eslint, enable more rules and fix their findings (#39438)

Update eslint and its plugins, enable more rules and fix their findings:

1. `unicorn/no-unsafe-string-replacement` found that uploading a file
whose name contains `$&` inserted a broken markdown link, because
`String#replace` expands such patterns in the replacement string
2. `@typescript-eslint/require-await` removes `async` from functions
that never await
3. Plugin rules not covered by a preset are now listed explicitly

---------

Co-authored-by: bircni <bircni@icloud.com>

web_src/js/render/plugin.ts

@@ -1,3 +1,5 @@
+import type {Promisable} from '../types.ts';
+
 // there are 2 kinds of plugins:
 // * "inplace" plugins: render file content in-place, e.g. PDF viewer
 // * "frontend" plugins: render file content in a separate iframe by a huge frontend library (need to protect from XSS risks)
@@ -18,4 +20,4 @@ export type FrontendRenderOptions = {
   contentBytes(): Uint8Array<ArrayBuffer>;
 };
 
-export type FrontendRenderFunc = (opts: FrontendRenderOptions) => Promise<boolean>;
+export type FrontendRenderFunc = (opts: FrontendRenderOptions) => Promisable<boolean>;