manual backport of #34886

per https://www.w3.org/TR/html-aria/#docconformance

> It is NOT RECOMMENDED to use `aria-disabled="true"` on an `a` element with an `href` attribute.
>
>NOTE
>If a link needs to be "disabled", remove the `href` attribute.

This PR removes the unnecessary `href="#"`, `tabindex="-1"`, and `aria-disabled="true"` from disabled links in both docs pages and examples. `aria-disabled="true"` *is* kept for disabled link-based buttons (that have `role="button"`) as there it's appropriate to use (you *want* to convey to assistive technologies that this thing you're claiming is a button is also disabled at the moment)

Further, the PR extends the "Link functionality caveat" to show the "proper" way (removing `href` and adding `.disabled` class only) to disable a link, but then explains what to do if that's not possible (and then keeps an example with all the traditional `href="#" tabindex="-1" aria-disabled="true"`, but explains clearly that it's not ideal). Same sort of explanation is also added to the pointer event utilities page

Fixes #34353

.

Co-Authored-By: Slaven Tomac <slaventomac@gmail.com>

* @babel/cli                       ^7.14.3  →  ^7.14.8
* @babel/core                      ^7.14.3  →  ^7.14.8
* @babel/preset-env                ^7.14.2  →  ^7.14.8
* @rollup/plugin-commonjs          ^19.0.0  →  ^19.0.1
* @rollup/plugin-node-resolve      ^13.0.0  →  ^13.0.2
* autoprefixer                     ^10.2.5  →  ^10.3.1
* eslint                           ^7.26.0  →  ^7.31.0
* eslint-config-xo                 ^0.36.0  →  ^0.37.0
* eslint-plugin-import             ^2.23.2  →  ^2.23.4
* eslint-plugin-unicorn            ^31.0.0  →  ^34.0.1
* globby                           ^11.0.3  →  ^11.0.4
* hugo-bin                         ^0.71.1  →  ^0.73.0
* karma                             ^6.3.2  →   ^6.3.4
* karma-firefox-launcher            ^2.1.0  →   ^2.1.1
* linkinator                       ^2.13.6  →  ^2.14.0
* nodemon                           ^2.0.7  →   ^2.0.12
* node-sass                         ^6.0.0  →   ^6.0.1
* postcss                  ...

Remove unneeded `.text-white-50` CSS rule

This is already part of Bootstrap 4.6 and 5.0.

Closes #34146 

---

Not sure what happened but indeed, [our current `$secondary` is not what's shown in docs](https://github.com/twbs/bootstrap/blob/c2f949c1fdad09e30793b533e5502808c5e2d423/scss/_variables.scss#L68).

* @babel/cli                       ^7.13.14  →   ^7.14.3
* @babel/core                       ^7.14.0  →   ^7.14.3
* @babel/preset-env                 ^7.14.1  →   ^7.14.2
* @rollup/plugin-commonjs           ^18.0.0  →   ^19.0.0
* @rollup/plugin-node-resolve       ^11.2.1  →   ^13.0.0
* clean-css-cli                      ^5.2.2  →    ^5.3.0
* eslint                            ^7.23.0  →   ^7.26.0
* eslint-config-xo                  ^0.35.0  →   ^0.36.0
* eslint-plugin-import              ^2.22.1  →   ^2.23.2
* eslint-plugin-unicorn             ^29.0.0  →   ^31.0.0
* glob                               ^7.1.6  →    ^7.1.7
* hugo-bin                          ^0.70.0  →   ^0.71.1
* node-sass                          ^5.0.0  →    ^6.0.0
* postcss                            ^8.2.9  →    ^8.3.0
* qunit                             ^2.14.1  →   ^2.15.0
* rollup                            ^2.44.0  →   ^2.48.0
* stylelint                        ^13.12.0  →  ^13.13.1
* stylelint-config-twbs-bootstrap    ^2.1.0  →    ^2.2.0
* vnu-jar                            21.2.5  →    21.4.9

`aria-haspopup="true"` is really intended to signal that an ARIA `menu` will be opened on activation. as a result, some assistive technologies will announce controls with `aria-haspopup="true"` as a menu or menu item (e.g. JAWS and NVDA).
In addition, `aria-haspopup` seems to trigger a bug in Edge/Narrator where the `aria-expanded` state is not correctly announced at the moment when `aria-haspopup` is present.
This now makes the dropdown button more like a generic disclosure widget control - see also https://www.w3.org/TR/wai-aria-practices-1.2/examples/disclosure/disclosure-navigation.html01

Carousel: use buttons, not links, for prev/next controls

* Update the default value for $enable-deprecation-messages

As seen in the https://github.com/twbs/bootstrap/blob/v4-dev/scss/_variables.scss,
the `$enable-deprecation-messages` variable is set to `true` by default.

* Add a callout for the sanitizer in popovers and tooltips

* Add second reference to sanitizer in the options

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

* use `in` instead of `strings.Contains` since the latter is not documented
* use `cond`

Pin karma and linkinator due to failures

* Bump version to v4.6.0.

* Dist

* Backport #32037

Add `.navbar-nav-scroll` for vertical scrolling of navbar content

* drop the css var for a Sass css

Co-authored-by: Mark Otto <markdotto@gmail.com>

Mention CSP and embedded SVGs in v4 docs

Add a live toast example to the docs

* Backport of changes to v5 docs that updated and clarified information about the Sass compiler used and the minimum rounding precision we recommend with it.

Co-authored-by: Mark Otto <otto@github.com>
Co-authored-by: XhmikosR <xhmikosr@gmail.com>

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

* Clarify Sass import and customize docs for how to modify variable defaults

* Add an npm starter project callout to a few pages

They're links, acting as links. Just because they're styled as buttons visually (as is often the case for "Call to action" (CTA) links) doesn't mean they need/get `role="button"`

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

* @babel/cli                   ^7.12.8  →  ^7.12.10
* @babel/core                  ^7.12.8  →  ^7.12.10
* @babel/preset-env            ^7.12.7  →  ^7.12.11
* @rollup/plugin-babel          ^5.2.1  →    ^5.2.2
* @rollup/plugin-commonjs      ^16.0.0  →   ^17.0.0
* @rollup/plugin-node-resolve  ^10.0.0  →   ^11.0.1
* autoprefixer                 ^10.0.2  →   ^10.2.1
* cross-env                     ^7.0.2  →    ^7.0.3
* eslint                       ^7.14.0  →   ^7.17.0
* eslint-config-xo             ^0.33.1  →   ^0.34.0
* eslint-plugin-unicorn        ^23.0.0  →   ^25.0.1
* find-unused-sass-variables    ^3.0.0  →    ^3.1.0
* hugo-bin                     ^0.66.2  →   ^0.68.0
* linkinator                    ^2.2.2  →   ^2.11.2
* nodemon                       ^2.0.6  →    ^2.0.7
* postcss                      ^8.1.10  →    ^8.2.3
* postcss-cli                   ^8.3.0  →    ^8.3.1
* qunit                        ^2.12.0  →   ^2.13.0
* rollup                 ...

Docs: Tweak the wording for collapse to indicate button is preferred/more semantic

Clarify the `$enable-shadows` option in our docs

Bump copyright year to 2021

While technically it still works, we're already saying authors shouldn't do it later on, and we removed any examples of this. This was a straggler.

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

Fix popover docs example

Co-authored-by: XhmikosR <xhmikosr@gmail.com>