Backport #28390 by @jackHay22

## Changes
- Add deprecation warning to `Token` and `AccessToken` authentication
methods in swagger.
- Add deprecation warning header to API response. Example: 
  ```
  HTTP/1.1 200 OK
  ...
  Warning: token and access_token API authentication is deprecated
  ...
  ```
- Add setting `DISABLE_QUERY_AUTH_TOKEN` to reject query string auth
tokens entirely. Default is `false`

## Next steps
- `DISABLE_QUERY_AUTH_TOKEN` should be true in a subsequent release and
the methods should be removed in swagger
- `DISABLE_QUERY_AUTH_TOKEN` should be removed and the implementation of
the auth methods in question should be removed

## Open questions
- Should there be further changes to the swagger documentation?
Deprecation is not yet supported for security definitions (coming in
[OpenAPI Spec version
3.2.0](https://github.com/OAI/OpenAPI-Specification/issues/2506))
- Should the API router logger sanitize urls that use `token` or
`access_token`? (This is obviously an insufficient solution on its own)

Co-authored-by: Jack Hay <jack@allspice.io>
Co-authored-by: delvh <dev.lh@web.de>

Backport #28379 by @lafriks

Before:

![image](https://github.com/go-gitea/gitea/assets/165205/e2e2256d-03c5-4ab8-8ed9-08ef68571a43)

After:

![image](https://github.com/go-gitea/gitea/assets/165205/804132ef-18f9-4ab8-949d-f6c71e7f4d24)

Co-authored-by: Lauris BH <lauris@nix.lv>

Backport #28359 by @lunny

The left menu will only display the default branch's workflows but the
right side will display the runs triggered by all branches' workflows.
So we cannot hide right side if default branch has no workflows.

Fix #28332 
Replace #28333

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

Backport #28351 by @KN4CK3R

Fix #28347

As there is no info how to reproduce it, I can't test it.
Fix may be `section_split.tmpl @ 126/130`.

Other changes are "empty check" refactorings.

Co-authored-by: KN4CK3R <admin@oldschoolhack.me>

Backport #28320 by @JakobDev

Fixes https://codeberg.org/Codeberg/Community/issues/1355

Co-authored-by: JakobDev <jakobdev@gmx.de>

Backport #28225 by @denyskon

Inspired by #28182 

Co-authored-by: Denys Konovalov <kontakt@denyskon.de>

Backport #28182 by @lng2020

Follow-up #22844 
close #28142 
Before 

![ksnip_20231123-183906](https://github.com/go-gitea/gitea/assets/70063547/78428a22-b0a0-45f9-9458-7fd5ec73aa29)
After

![full](https://github.com/go-gitea/gitea/assets/70063547/047242cf-9d6c-4b3a-9f92-54102740c27e)

Co-authored-by: Nanguan Lin <70063547+lng2020@users.noreply.github.com>

Backport #28179 by @lng2020

fix #28173 
regression #25948 
That PR is supposed to only change the style but somehow delete a code
snippet. See the
diff(https://github.com/go-gitea/gitea/pull/25948/files#diff-7c36d66fe058f4ff9f2beaac73cf710dca45b350d0dd98daf806828a4745fe62L125-L129)
for details.

Co-authored-by: Nanguan Lin <70063547+lng2020@users.noreply.github.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

Backport #28101 by @lng2020

Reverts go-gitea/gitea#27141
close #28097

Co-authored-by: Nanguan Lin <70063547+lng2020@users.noreply.github.com>

Backport #28164 by @yp05327


![image](https://github.com/go-gitea/gitea/assets/18380374/380859b2-a643-42fd-b53e-78c93c05c826)
Don't know why there's a `.` behind. 🤔

Co-authored-by: yp05327 <576951401@qq.com>

Backport #28145 by @yp05327

Before:

![image](https://github.com/go-gitea/gitea/assets/18380374/599d40c1-9b8d-4189-9286-c9c36fb780dd)

After:

![image](https://github.com/go-gitea/gitea/assets/18380374/848a73d1-aaec-478f-93a7-adcc7ee18907)

Co-authored-by: yp05327 <576951401@qq.com>

Backport #28146 by @yp05327

Before:

![image](https://github.com/go-gitea/gitea/assets/18380374/3012f544-7ff5-4ccb-ac80-ce24d50abe97)

After:

![image](https://github.com/go-gitea/gitea/assets/18380374/4084312a-9ac0-4103-8c93-ea178ae24493)

![image](https://github.com/go-gitea/gitea/assets/18380374/3c47d175-0735-476d-8979-da2bc0a4fc95)

![image](https://github.com/go-gitea/gitea/assets/18380374/033c6a81-d1f7-4426-8063-5793d0b47462)

Co-authored-by: yp05327 <576951401@qq.com>

Backport #28113 by @lunny

Fix #27901

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

Backport #28034 by @yp05327

Before:

![image](https://github.com/go-gitea/gitea/assets/18380374/ed464937-e20d-4f5b-b997-e86c2d96469d)

After:

![image](https://github.com/go-gitea/gitea/assets/18380374/471e77b3-516e-4ae9-b901-0cf8745eb9aa)

Co-authored-by: yp05327 <576951401@qq.com>

Backport #27924 by @yp05327

In #25315, @denyskon fixed UI on mobile view.
But for the repo description, on desktop view there's no word-break. 
So maybe we can just add `gt-word-break` to fix it on both mobile view
and desktop view.

Before:
desktop view:

![image](https://github.com/go-gitea/gitea/assets/18380374/a7659f5b-fbe9-400a-8cc2-cca44778556e)
mobile view:

![image](https://github.com/go-gitea/gitea/assets/18380374/611f1b81-58ac-4213-b165-5c73e24ca79e)

After:
desktop view:

![image](https://github.com/go-gitea/gitea/assets/18380374/f21bf3a7-f6aa-457d-9bfa-5c57659c68b1)
mobile view(almost same?)

![image](https://github.com/go-gitea/gitea/assets/18380374/ad2d1a4d-1172-402c-b5fc-5e910657847d)

Co-authored-by: yp05327 <576951401@qq.com>
Co-authored-by: silverwind <me@silverwind.io>

Backport #27927 by @invliD

When an assignee changed event comment is rendered, most of it is
guarded behind the assignee ID not being 0. However, if it is 0, that
results in quite broken rendering for that comment and the next one.
This can happen, for example, when repository data imported from outside
of Gitea is incomplete.

This PR makes sure comments with an assignee ID of 0 are not rendered at
all.

---

Screenshot before:
<img width="272" alt="Bildschirm­foto 2023-11-05 um 20 12 18"
src="https://github.com/go-gitea/gitea/assets/42910/7d629d76-fee4-4fe5-9e3a-bf524050cead">
The comments in this screenshot are:
1. A regular text comment
2. A user being unassigned
3. A user being assigned
4. The title of the PR being changed

Comments 2 and 3 are rendered without any text, which indents the next
comment and does not leave enough vertical space.

Co-authored-by: Sebastian Brückner <code@nik.dev>

Backport #27942 by @yp05327

Before:

![image](https://github.com/go-gitea/gitea/assets/18380374/74c925e0-15ae-4602-8b56-0b69f54a5e7a)

After:

![image](https://github.com/go-gitea/gitea/assets/18380374/027c34ef-0cbc-4156-a198-44bf5dd924e2)

Co-authored-by: yp05327 <576951401@qq.com>

Backport #27916 by @sebastian-sauer

Show the correct sha when viewing a single commit.


![image](https://github.com/go-gitea/gitea/assets/1135157/5f39a84e-11ed-4700-b40b-eb9da6e91bec)

Co-authored-by: sebastian-sauer <sauer.sebastian@gmail.com>

Backport #27892 by @earl-warren

- Remove the set tabindex and instead let the browser figure out the
correct tab order.
- Resolves https://codeberg.org/forgejo/forgejo/issues/1626

Co-authored-by: Earl Warren <109468362+earl-warren@users.noreply.github.com>
Co-authored-by: Gusted <postmaster@gusted.xyz>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

Backport #27856

The only conflict is `ThemeName` in `500.tmpl`, it has been resolved
manually by keeping using old
`{{.SignedUser.Theme}}{{else}}{{DefaultTheme}}`

Backport #27839 by @lunny

Fix #23742

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
Co-authored-by: KN4CK3R <admin@oldschoolhack.me>

Backport #27815 by @denyskon

Starting from #25790 this shared template only linked the username of
the user if both display name and username were shown. I experienced
myself always trying to click on the display name - I think it is
annoying for others too.

After:


![grafik](https://github.com/go-gitea/gitea/assets/47871822/a0e82127-b773-4ca4-890f-d18422a7bef2)

![grafik](https://github.com/go-gitea/gitea/assets/47871822/79efcf93-2f50-4fc4-ba15-afc6174be48c)

Co-authored-by: Denys Konovalov <kontakt@denyskon.de>

Backport #27788 by @silverwind

Fixes: https://github.com/go-gitea/gitea/issues/27784

<img width="1033" alt="Screenshot 2023-10-25 at 19 07 15"
src="https://github.com/go-gitea/gitea/assets/115237/1a363851-1a86-48cb-99ec-0a573371bb6e">
<img width="1051" alt="Screenshot 2023-10-25 at 19 07 41"
src="https://github.com/go-gitea/gitea/assets/115237/add4b606-2264-430a-af35-249ef005817f">

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: KN4CK3R <admin@oldschoolhack.me>

Backport #27755 by wxiaoguang

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

Backport #27713 by @silverwind

Fixes: https://github.com/go-gitea/gitea/issues/27600


![](https://github.com/go-gitea/gitea/assets/115237/96743d90-0712-4f13-84ec-66f84e6ed2d7)

Also tested together with https://github.com/go-gitea/gitea/pull/27704,
works well.

Co-authored-by: silverwind <me@silverwind.io>

Backport #27356 by @silverwind

Various improvements related to feeds:

- Fix markdown rendering
- Increase font size from 13px to default 14px via `flex-item`
- Add style to hashes
- Move the timestamp to title line. I realize it's not optimal for
translation, we may need to change all these translations

Before:
<img width="768" alt="Screenshot 2023-09-29 at 22 52 58"
src="https://github.com/go-gitea/gitea/assets/115237/edda8b84-23cf-4a43-90ad-a892798f4e6c">

After:
<img width="781" alt="Screenshot 2023-09-29 at 22 58 09"
src="https://github.com/go-gitea/gitea/assets/115237/7097474d-efcf-4f22-a2ab-834a4e25c4e8">

Co-authored-by: silverwind <me@silverwind.io>

Backport #27498 by @silverwind

1. Improve various feed icons
2. Fix merge message color


<img width="763" alt="image"
src="https://github.com/go-gitea/gitea/assets/115237/3f5bcb23-6d90-4c63-85f2-46bd7e1c96d6">
<img width="769" alt="image"
src="https://github.com/go-gitea/gitea/assets/115237/466c37b4-e2f4-42bb-922d-b86596cdc6d0">


Fixes: https://github.com/go-gitea/gitea/issues/27495
Continues: https://github.com/go-gitea/gitea/pull/27356

Co-authored-by: silverwind <me@silverwind.io>

Backport #27644 by @denyskon

Fix #27596 

Change confusing behavior when showing information about a repo via labels and icons.
Implement changes proposed by @lng2020 in
https://github.com/go-gitea/gitea/pull/27627#pullrequestreview-1678787673.

Co-authored-by: Denys Konovalov <kontakt@denyskon.de>

Backport #27592 by @JakobDev

If you set a checkbox as required in a issue form at the moment, the
checkbox is checked and read only, what does not make much sense. With
this PR, the Checkbox actually needs to be checked. The label supports
now also Markdown. This matches GitHub's behaviour.

And yes, I know the CSS is a ugly workaround. It looks like the given
CSS code is part Fomantic and I don't know how to change that. The
Maintainers are free to change that.


![grafik](https://github.com/go-gitea/gitea/assets/15185051/3f35be75-b0b4-42a7-9048-a4970384a035)

Co-authored-by: JakobDev <jakobdev@gmx.de>

Backport #27451 by @puni9869

Followup of #27115
Finally closes #25237

## Screenshots
### Issue Sidebar
<img width="513" alt="image"
src="https://github.com/go-gitea/gitea/assets/80308335/9f7fda2f-5a03-4684-8619-fd3498a95b41">

### PR sidebar
<img width="367" alt="image"
src="https://github.com/go-gitea/gitea/assets/80308335/53db9b64-faec-4a67-91d6-76945596a469">

### PR sidebar with archived labels shown
<img width="352" alt="image"
src="https://github.com/go-gitea/gitea/assets/80308335/9dc5050f-4e69-4f76-bb83-582480a2281e">

Signed-off-by: puni9869 <punitinani1@hotmail.com>
Co-authored-by: puni9869 <80308335+puni9869@users.noreply.github.com>
Co-authored-by: silverwind <me@silverwind.io>

Backport #27632 by @wxiaoguang

1. fix #27631 , and add samples to devtest page
2. fix incorrect color for "ui dropdown button" when hover

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

backport #27514 
close #27607

Backport #27192 by @JakobDev

Fixes https://codeberg.org/Codeberg/Community/issues/1302

Co-authored-by: JakobDev <jakobdev@gmx.de>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

Backport #27585 by @JakobDev

Fixes https://codeberg.org/forgejo/forgejo/issues/1592

When login in with WebAuth, the page has a link to use TOTP instead.
This link is always displayed, no matter if the User has set up TOTP or
not, which do of cause not work for those who have not.

Co-authored-by: JakobDev <jakobdev@gmx.de>

Backport #27267 by @silverwind

1. Dropzone attachment removal, pretty simple replacement
2. Image diff: The previous code fetched every image twice, once via
`img[src]` and once via `$.ajax`. Now it's only fetched once and a
second time only when necessary. The image diff code was partially
rewritten.

Co-authored-by: silverwind <me@silverwind.io>

Reverts backport go-gitea/gitea#27440
Fix #27564

Backport #27359 by @kdumontnu

Closes https://github.com/go-gitea/gitea/issues/27358

Co-authored-by: Kyle D <kdumontnu@gmail.com>

Backport #27483 by @msantos

Fixes https://github.com/go-gitea/gitea/issues/27481

---
Patch tested:

```json
[
  {
    "url": "7664dcb441",
    "sha": "7664dcb44167e0f9efd994e4ca6a9164694adc27",
    "created": "2023-10-06T09:57:08-04:00",
    "html_url": "7664dcb441",
...
    "files": [
      {
        "filename": "README.md",
        "status": "modified"
      }
    ],
    "stats": {
      "total": 2,
      "additions": 2,
      "deletions": 0
    }
  }
]
```

Co-authored-by: Michael Santos <michael.santos@gmail.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

Backport #27504 by @silverwind

Partial revert of https://github.com/go-gitea/gitea/pull/25839. This
commit status is used by a number of external integrations, so I think
we should not remove it (See
https://github.com/go-gitea/gitea/pull/25839#issuecomment-1729002077).
This is a rare case where an existing migration needed to be alterted to
avoid data loss.

Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: delvh <dev.lh@web.de>

Backport https://github.com/go-gitea/gitea/pull/27501 to 1.21

- Update all JS and PY dependencies
- Enable eslint `prefer-object-has-own` and autofix issue
- Fix styling on citation buttons
- Tested citation, mermaid, monaco, swagger, katex

Citation button issue was that these buttons were not filled:

<img width="136" alt="Screenshot 2023-10-07 at 14 05 08"
src="https://github.com/go-gitea/gitea/assets/115237/435f0c91-28ac-46b3-bae4-dad768b29c05">

Co-authored-by: techknowlogick <techknowlogick@gitea.com>
Co-authored-by: Giteabot <teabot@gitea.io>

Apparently, we didn't backport one of the refactoring PRs which caused
the fixup we backported to fail.

Fixes: https://github.com/go-gitea/gitea/issues/27473

Backport #27000 by @wxiaoguang

This PR reduces the complexity of the system setting system.

It only needs one line to introduce a new option, and the option can be
used anywhere out-of-box.

It is still high-performant (and more performant) because the config
values are cached in the config system.


![image](https://github.com/go-gitea/gitea/assets/2114189/f8cdd743-1145-41ab-9f8f-3996aa97d440)

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

Backport #27436 by @lunny

Fix #27431

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>

Backport #27434 by @CaiCandong

Fix  #27432
Regression of #27265

Co-authored-by: CaiCandong <50507092+CaiCandong@users.noreply.github.com>

Backport #27417 by @delvh

Fixes #27416

Co-authored-by: delvh <dev.lh@web.de>

Backport #27418 by @silverwind

Same as https://github.com/go-gitea/gitea/pull/26046 but for repo and
org settings pages, reducing the margins between the boxes:

<img width="1247" alt="Screenshot 2023-10-03 at 23 25 19"
src="https://github.com/go-gitea/gitea/assets/115237/4e68ad5e-5fdc-4466-aefb-ec71bf411d45">
<img width="1255" alt="Screenshot 2023-10-03 at 23 27 12"
src="https://github.com/go-gitea/gitea/assets/115237/9068369b-a75d-401e-8b8d-3bd4bbe097dc">

Co-authored-by: silverwind <me@silverwind.io>

Backport #27115 by @puni9869

Followup  https://github.com/go-gitea/gitea/pull/26820
## Archived labels UI for issue filter and issue filter actions for
issues/pull request pages.

Changed:
* Enhanced the Issue filter and Issue filter actions UI page to
seamlessly incorporate a list of archived labels.
* Pagination functionality is same as before. If archived label checkbox
is checked then we are adding a query string`archived=true` in the url
to save the state of page.
* Issue filter actions menu is separated into different template.
* Adding the archived flag in issue url labels.
* Pull Request page is also work the same.

Outsourced:
* Defer the implementation of specialized handling for archived labels
to upcoming pull requests. This step will be undertaken subsequent to
the successful merge of this pull request.

Screenshots
### Issue page
<img width="1360" alt="image"
src="https://github.com/go-gitea/gitea/assets/80308335/d7efb2ef-5b2b-449d-83f0-d430a32ec432">

### Issue page with label filter on archived label checkbox when not
checked --> No archived label is there in list
<img width="1249" alt="image"
src="https://github.com/go-gitea/gitea/assets/80308335/ceea68ef-91f2-4693-910f-2e25e236bfc9">

### Issue page with label filter on archived label checkbox when checked
--> Show archived label in the list.
<img width="710" alt="image"
src="https://github.com/go-gitea/gitea/assets/80308335/2414d26b-2079-4c3c-bd9e-f2f5411bcabf">

### Issue page with label filter on issue action menu on archived label
checkbox when checked --> Show archived label in the list.
<img width="409" alt="image"
src="https://github.com/go-gitea/gitea/assets/80308335/259cac87-3e21-4778-99a2-a6a0b8c81178">


### Applied the archived=true in Issue labels when archived checkbox is
checked.
<img width="984" alt="image"
src="https://github.com/go-gitea/gitea/assets/80308335/657ce3db-c0ae-402e-b12d-3b580d3c2ed0">

---




Part of https://github.com/go-gitea/gitea/issues/25237

Signed-off-by: puni9869 <punitinani1@hotmail.com>
Co-authored-by: puni9869 <80308335+puni9869@users.noreply.github.com>
Co-authored-by: delvh <dev.lh@web.de>

Backport #26998 by @denyskon

This PR adds a separated column in the users table for operations. The
username link now redirects back to user page.


![grafik](https://github.com/go-gitea/gitea/assets/47871822/df8c8b30-3da6-443c-ae0f-6e3cac7dd9bb)

Resolves
https://github.com/go-gitea/gitea/pull/26713#pullrequestreview-1603001285

Co-authored-by: silverwind <me@silverwind.io>

Co-authored-by: Denys Konovalov <kontakt@denyskon.de>
Co-authored-by: silverwind <me@silverwind.io>

Backport #27372 by @CaiCandong

As title
Fix #27369
Regression of #27265

Co-authored-by: CaiCandong <50507092+CaiCandong@users.noreply.github.com>

Backport #27362 by @lunny

Fix #27361

Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>