following on from https://github.com/twbs/bootstrap/pull/35213 this

- expands the note, making it clear it's not supported
- makes it a callout

- a few rewordings/tweaks
- add info about toasts with focusable/actionable controls (shouldn't autohide them)

manual backport of https://github.com/twbs/bootstrap/pull/33810

* Use param to set Bootstrap version in Contents doc

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

Manual backport of https://github.com/twbs/bootstrap/pull/33797

* Bump version to v4.6.1

* Dist

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

manual backport of #34886

per https://www.w3.org/TR/html-aria/#docconformance

> It is NOT RECOMMENDED to use `aria-disabled="true"` on an `a` element with an `href` attribute.
>
>NOTE
>If a link needs to be "disabled", remove the `href` attribute.

This PR removes the unnecessary `href="#"`, `tabindex="-1"`, and `aria-disabled="true"` from disabled links in both docs pages and examples. `aria-disabled="true"` *is* kept for disabled link-based buttons (that have `role="button"`) as there it's appropriate to use (you *want* to convey to assistive technologies that this thing you're claiming is a button is also disabled at the moment)

Further, the PR extends the "Link functionality caveat" to show the "proper" way (removing `href` and adding `.disabled` class only) to disable a link, but then explains what to do if that's not possible (and then keeps an example with all the traditional `href="#" tabindex="-1" aria-disabled="true"`, but explains clearly that it's not ideal). Same sort of explanation is also added to the pointer event utilities page

Fixes #34353

.

Co-Authored-By: Slaven Tomac <slaventomac@gmail.com>

* @babel/cli                       ^7.14.3  →  ^7.14.8
* @babel/core                      ^7.14.3  →  ^7.14.8
* @babel/preset-env                ^7.14.2  →  ^7.14.8
* @rollup/plugin-commonjs          ^19.0.0  →  ^19.0.1
* @rollup/plugin-node-resolve      ^13.0.0  →  ^13.0.2
* autoprefixer                     ^10.2.5  →  ^10.3.1
* eslint                           ^7.26.0  →  ^7.31.0
* eslint-config-xo                 ^0.36.0  →  ^0.37.0
* eslint-plugin-import             ^2.23.2  →  ^2.23.4
* eslint-plugin-unicorn            ^31.0.0  →  ^34.0.1
* globby                           ^11.0.3  →  ^11.0.4
* hugo-bin                         ^0.71.1  →  ^0.73.0
* karma                             ^6.3.2  →   ^6.3.4
* karma-firefox-launcher            ^2.1.0  →   ^2.1.1
* linkinator                       ^2.13.6  →  ^2.14.0
* nodemon                           ^2.0.7  →   ^2.0.12
* node-sass                         ^6.0.0  →   ^6.0.1
* postcss                  ...

Remove unneeded `.text-white-50` CSS rule

This is already part of Bootstrap 4.6 and 5.0.

Closes #34146 

---

Not sure what happened but indeed, [our current `$secondary` is not what's shown in docs](https://github.com/twbs/bootstrap/blob/c2f949c1fdad09e30793b533e5502808c5e2d423/scss/_variables.scss#L68).

* @babel/cli                       ^7.13.14  →   ^7.14.3
* @babel/core                       ^7.14.0  →   ^7.14.3
* @babel/preset-env                 ^7.14.1  →   ^7.14.2
* @rollup/plugin-commonjs           ^18.0.0  →   ^19.0.0
* @rollup/plugin-node-resolve       ^11.2.1  →   ^13.0.0
* clean-css-cli                      ^5.2.2  →    ^5.3.0
* eslint                            ^7.23.0  →   ^7.26.0
* eslint-config-xo                  ^0.35.0  →   ^0.36.0
* eslint-plugin-import              ^2.22.1  →   ^2.23.2
* eslint-plugin-unicorn             ^29.0.0  →   ^31.0.0
* glob                               ^7.1.6  →    ^7.1.7
* hugo-bin                          ^0.70.0  →   ^0.71.1
* node-sass                          ^5.0.0  →    ^6.0.0
* postcss                            ^8.2.9  →    ^8.3.0
* qunit                             ^2.14.1  →   ^2.15.0
* rollup                            ^2.44.0  →   ^2.48.0
* stylelint                        ^13.12.0  →  ^13.13.1
* stylelint-config-twbs-bootstrap    ^2.1.0  →    ^2.2.0
* vnu-jar                            21.2.5  →    21.4.9

`aria-haspopup="true"` is really intended to signal that an ARIA `menu` will be opened on activation. as a result, some assistive technologies will announce controls with `aria-haspopup="true"` as a menu or menu item (e.g. JAWS and NVDA).
In addition, `aria-haspopup` seems to trigger a bug in Edge/Narrator where the `aria-expanded` state is not correctly announced at the moment when `aria-haspopup` is present.
This now makes the dropdown button more like a generic disclosure widget control - see also https://www.w3.org/TR/wai-aria-practices-1.2/examples/disclosure/disclosure-navigation.html01

Carousel: use buttons, not links, for prev/next controls

* Update the default value for $enable-deprecation-messages

As seen in the https://github.com/twbs/bootstrap/blob/v4-dev/scss/_variables.scss,
the `$enable-deprecation-messages` variable is set to `true` by default.

* Add a callout for the sanitizer in popovers and tooltips

* Add second reference to sanitizer in the options

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

* use `in` instead of `strings.Contains` since the latter is not documented
* use `cond`

Pin karma and linkinator due to failures

* Bump version to v4.6.0.

* Dist

* Backport #32037

Add `.navbar-nav-scroll` for vertical scrolling of navbar content

* drop the css var for a Sass css

Co-authored-by: Mark Otto <markdotto@gmail.com>

Mention CSP and embedded SVGs in v4 docs

Add a live toast example to the docs