Merge upstream changes (v2.6.1)

Fix #9170

This reverts commit c36a4a1617.

* Bump version to 2.6.0

* Update CHANGELOG.md

* Update oc.json

* Update oc.yml

* Update simple_form.oc.yml

* Update simple_form.oc.yml

* Update oc.json

Merge upstream changes

uWS has no support node11 yet.

Port f59b840549 to glitch-soc

Conflicts:
- app/controllers/auth/sessions_controller.rb

Upstream reverted something we partially reverted already.
Reverted the rest to match upstream.

Port 9c38c5daa3 to glitch-soc

Port 795f0107d2 to glitch-soc

* Bump version to 2.6.0rc4

* Update CHANGELOG.md

Fix #9131

Fix #9130

This reverts commit 10680f93e7.

* Add profile to json+ld in Accept

It's required by the ActivityPub spec

* Use headers['Content-type'] instead of mime_type

mime_type strips the profile from the content type, but it's still available raw in the headers hash

* Add test for ld+json with profile

* Update oc.json

* Update devise.oc.yml

* Update oc.yml

* Update oc.json

* Always let through notifications from staff

Follow-up to #8993

* Let messages from staff through, but no other notifications

Bumps [loofah](https://github.com/flavorjones/loofah) from 2.2.2 to 2.2.3. **This update includes security fixes.**
- [Release notes](https://github.com/flavorjones/loofah/releases)
- [Changelog](https://github.com/flavorjones/loofah/blob/master/CHANGELOG.md)
- [Commits](https://github.com/flavorjones/loofah/compare/v2.2.2...v2.2.3)

Signed-off-by: dependabot[bot] <support@dependabot.com>

Merge upstream changes

Port e961a763a2 to glitch-soc

Port 5ee0b51ac8 to glitch-soc

Bumps [oj](https://github.com/ohler55/oj) from 3.6.12 to 3.7.0.
- [Release notes](https://github.com/ohler55/oj/releases)
- [Changelog](https://github.com/ohler55/oj/blob/master/CHANGELOG.md)
- [Commits](https://github.com/ohler55/oj/compare/v3.6.12...v3.7.0)

Signed-off-by: dependabot[bot] <support@dependabot.com>

* Remove class from scrollable div

.detailed-status__wrapper does not actually wrap the detailed status here

* Re-add class to focusable div

.detailed-status__wrapper now wraps the detailed status instead of the entire scrollable area

* RTL: fix preferences page checkbox margins

* Update rtl.scss

* Do not hide boost notifications from followed people with hidden boosts

Not displaying boosts from a followed user in the Home timeline and not
having notifications when they reblog your own content are two very
separate concerns, tying them together seem counter-intuitive and unwanted.

* Update specs accordingly

Merge upstream changes

* Bump version to 2.6.0rc3

* Update CHANGELOG.md

Conflicts:
- config/locales/simple_form.ja.yml

Not a real conflict, one new string was introduced in
glitch and one in upstream.

Just a grammar improvement.