* Bump version to v4.6.1

* Dist

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

manual backport of #34886

per https://www.w3.org/TR/html-aria/#docconformance

> It is NOT RECOMMENDED to use `aria-disabled="true"` on an `a` element with an `href` attribute.
>
>NOTE
>If a link needs to be "disabled", remove the `href` attribute.

This PR removes the unnecessary `href="#"`, `tabindex="-1"`, and `aria-disabled="true"` from disabled links in both docs pages and examples. `aria-disabled="true"` *is* kept for disabled link-based buttons (that have `role="button"`) as there it's appropriate to use (you *want* to convey to assistive technologies that this thing you're claiming is a button is also disabled at the moment)

Further, the PR extends the "Link functionality caveat" to show the "proper" way (removing `href` and adding `.disabled` class only) to disable a link, but then explains what to do if that's not possible (and then keeps an example with all the traditional `href="#" tabindex="-1" aria-disabled="true"`, but explains clearly that it's not ideal). Same sort of explanation is also added to the pointer event utilities page

Fixes #34353

.

Co-Authored-By: Slaven Tomac <slaventomac@gmail.com>

* @babel/cli                       ^7.14.3  →  ^7.14.8
* @babel/core                      ^7.14.3  →  ^7.14.8
* @babel/preset-env                ^7.14.2  →  ^7.14.8
* @rollup/plugin-commonjs          ^19.0.0  →  ^19.0.1
* @rollup/plugin-node-resolve      ^13.0.0  →  ^13.0.2
* autoprefixer                     ^10.2.5  →  ^10.3.1
* eslint                           ^7.26.0  →  ^7.31.0
* eslint-config-xo                 ^0.36.0  →  ^0.37.0
* eslint-plugin-import             ^2.23.2  →  ^2.23.4
* eslint-plugin-unicorn            ^31.0.0  →  ^34.0.1
* globby                           ^11.0.3  →  ^11.0.4
* hugo-bin                         ^0.71.1  →  ^0.73.0
* karma                             ^6.3.2  →   ^6.3.4
* karma-firefox-launcher            ^2.1.0  →   ^2.1.1
* linkinator                       ^2.13.6  →  ^2.14.0
* nodemon                           ^2.0.7  →   ^2.0.12
* node-sass                         ^6.0.0  →   ^6.0.1
* postcss                  ...

Remove unneeded `.text-white-50` CSS rule

This is already part of Bootstrap 4.6 and 5.0.

Closes #34146 

---

Not sure what happened but indeed, [our current `$secondary` is not what's shown in docs](https://github.com/twbs/bootstrap/blob/c2f949c1fdad09e30793b533e5502808c5e2d423/scss/_variables.scss#L68).

* @babel/cli                       ^7.13.14  →   ^7.14.3
* @babel/core                       ^7.14.0  →   ^7.14.3
* @babel/preset-env                 ^7.14.1  →   ^7.14.2
* @rollup/plugin-commonjs           ^18.0.0  →   ^19.0.0
* @rollup/plugin-node-resolve       ^11.2.1  →   ^13.0.0
* clean-css-cli                      ^5.2.2  →    ^5.3.0
* eslint                            ^7.23.0  →   ^7.26.0
* eslint-config-xo                  ^0.35.0  →   ^0.36.0
* eslint-plugin-import              ^2.22.1  →   ^2.23.2
* eslint-plugin-unicorn             ^29.0.0  →   ^31.0.0
* glob                               ^7.1.6  →    ^7.1.7
* hugo-bin                          ^0.70.0  →   ^0.71.1
* node-sass                          ^5.0.0  →    ^6.0.0
* postcss                            ^8.2.9  →    ^8.3.0
* qunit                             ^2.14.1  →   ^2.15.0
* rollup                            ^2.44.0  →   ^2.48.0
* stylelint                        ^13.12.0  →  ^13.13.1
* stylelint-config-twbs-bootstrap    ^2.1.0  →    ^2.2.0
* vnu-jar                            21.2.5  →    21.4.9

`aria-haspopup="true"` is really intended to signal that an ARIA `menu` will be opened on activation. as a result, some assistive technologies will announce controls with `aria-haspopup="true"` as a menu or menu item (e.g. JAWS and NVDA).
In addition, `aria-haspopup` seems to trigger a bug in Edge/Narrator where the `aria-expanded` state is not correctly announced at the moment when `aria-haspopup` is present.
This now makes the dropdown button more like a generic disclosure widget control - see also https://www.w3.org/TR/wai-aria-practices-1.2/examples/disclosure/disclosure-navigation.html01

Carousel: use buttons, not links, for prev/next controls

* Update the default value for $enable-deprecation-messages

As seen in the https://github.com/twbs/bootstrap/blob/v4-dev/scss/_variables.scss,
the `$enable-deprecation-messages` variable is set to `true` by default.

* Add a callout for the sanitizer in popovers and tooltips

* Add second reference to sanitizer in the options

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

* use `in` instead of `strings.Contains` since the latter is not documented
* use `cond`

Pin karma and linkinator due to failures

* Bump version to v4.6.0.

* Dist

* Backport #32037

Add `.navbar-nav-scroll` for vertical scrolling of navbar content

* drop the css var for a Sass css

Co-authored-by: Mark Otto <markdotto@gmail.com>

Mention CSP and embedded SVGs in v4 docs

Add a live toast example to the docs

* Backport of changes to v5 docs that updated and clarified information about the Sass compiler used and the minimum rounding precision we recommend with it.

Co-authored-by: Mark Otto <otto@github.com>
Co-authored-by: XhmikosR <xhmikosr@gmail.com>

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

* Clarify Sass import and customize docs for how to modify variable defaults

* Add an npm starter project callout to a few pages

They're links, acting as links. Just because they're styled as buttons visually (as is often the case for "Call to action" (CTA) links) doesn't mean they need/get `role="button"`

Co-authored-by: XhmikosR <xhmikosr@gmail.com>

* @babel/cli                   ^7.12.8  →  ^7.12.10
* @babel/core                  ^7.12.8  →  ^7.12.10
* @babel/preset-env            ^7.12.7  →  ^7.12.11
* @rollup/plugin-babel          ^5.2.1  →    ^5.2.2
* @rollup/plugin-commonjs      ^16.0.0  →   ^17.0.0
* @rollup/plugin-node-resolve  ^10.0.0  →   ^11.0.1
* autoprefixer                 ^10.0.2  →   ^10.2.1
* cross-env                     ^7.0.2  →    ^7.0.3
* eslint                       ^7.14.0  →   ^7.17.0
* eslint-config-xo             ^0.33.1  →   ^0.34.0
* eslint-plugin-unicorn        ^23.0.0  →   ^25.0.1
* find-unused-sass-variables    ^3.0.0  →    ^3.1.0
* hugo-bin                     ^0.66.2  →   ^0.68.0
* linkinator                    ^2.2.2  →   ^2.11.2
* nodemon                       ^2.0.6  →    ^2.0.7
* postcss                      ^8.1.10  →    ^8.2.3
* postcss-cli                   ^8.3.0  →    ^8.3.1
* qunit                        ^2.12.0  →   ^2.13.0
* rollup                 ...