Merge upstream changes

Port 2e1b5edfea to glitch-soc

Port 4f42238c29 to glitch-soc

Port 90b64c0069 to glitch-soc

This is both for consistency with account timelines and to not mess with
the logic used to decide whether going back in the browser's history is
going to make us leave the WebUI.

Port 8182b61518 to glitch-soc

Port 4eeda67727 to glitch-soc

Port 06252ec71e to glitch-soc

Port 5ea643b279 to glitch-soc

Port 46061dc041 to glitch-soc

Port 7403e5d306 to glitch-soc

Merge upstream changes

Port 12ab15e584 to glitch-soc

Port 13dce12665 to glitch-soc

Port SCSS changes from 087e118971 to glitch flavour

Conflicts:
- app/controllers/admin/base_controller.rb
  Some refactoring made upstream, no real conflict.
- app/javascript/mastodon/features/compose/components/compose_form.js
  Updated using upstream's code but using maxChars instead of the
  hardcoded length of 500 characters per toot.
- app/javascript/styles/mastodon/components.scss
  Upstream redesigned the onboarding modal. Not sure why we had a
  conflict there.

Bumps [nokogiri](https://github.com/sparklemotion/nokogiri) from 1.8.5 to 1.9.1.
- [Release notes](https://github.com/sparklemotion/nokogiri/releases)
- [Changelog](https://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.md)
- [Commits](https://github.com/sparklemotion/nokogiri/compare/v1.8.5...v1.9.1)

Signed-off-by: dependabot[bot] <support@dependabot.com>

This allowed you to brick your system when running that command, because the accounts would continue to advertise the old public key, but sign things with the new one

It should not be necessary thanks to our Content Security Policy, but best
be sure in case a server's CSP is incorrect. Also, avoids a CSP warning about
loading remote scripts.

* Make sure loading indicator has enough vertical space
* Respect reduce_motion setting for loading indicator

Port 4ede51743e to glitch-soc

* Add failing test for windows-1251 link cards

* Ignore low-confidence CharlockHolmes guesses

Fixes #9466

* Fix no method error when charlock holmes cannot detect charset

* Make sure loading indicator has enough vertical space

* Respect reduce_motion setting for loading indicator

Fixes #855

* Move #set_user to Admin::BaseController

* Rename Admin::TwoFactorAuthenticationsController

from `#set_user` to `#set_target_user` .

* Prepare to load onboarding as a full page

* Update the first-time introduction

* Improve responsive design

* Replace speech bubble with logo

* Increase text size and reword first paragraph

Bumps [omniauth](https://github.com/omniauth/omniauth) from 1.8.1 to 1.9.0.
- [Release notes](https://github.com/omniauth/omniauth/releases)
- [Commits](https://github.com/omniauth/omniauth/compare/v1.8.1...v1.9.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

* Remove "most popular" tab from profile directory, add responsive design

* Remove unused translations

Add timeout of 10s to web push requests

There is no reason to disable the composer textarea when some media metadata
is being modified, nor is there any reason to focus the textarea when some
media metadata has been modified (prevents clicking one image's description
field right after having modified another).