* giteaofficial/main:
  [skip ci] Updated translations via Crowdin
  Catch the error before the response is processed by goth. (go-gitea#20000)
  Adjust transaction handling via db.Context (go-gitea#20031)
  Add more linters to improve code readability (go-gitea#19989)
  [skip ci] Updated translations via Crowdin
  Disable federation by default (go-gitea#20045)
  Respond with a 401 on git push when password isn't changed yet (go-gitea#20026)
  Alter hook_task TEXT fields to LONGTEXT (go-gitea#20038)
  Simplify and fix migration 216 (go-gitea#20035)
  use quoted regexp instead of git fixed-value (go-gitea#20029)
  fix delete pull head ref for DeleteIssue (go-gitea#20032)
  User keypairs and HTTP signatures for ActivityPub federation using go-ap (go-gitea#19133)
  Backtick table name in generic orphan check (go-gitea#20019)
  Update document to clarify that ALLOWED_DOMAINS/BLOCKED_DOMAINS support wildcard (go-gitea#20016)
  Return 404 when tag is broken (go-gitea#20017)
  Dump should only copy regular files and symlink regular files (go-gitea#20015)

…20102)

The code introduced by #18185 gets the error from response after it was processed by goth.

That is incorrect, as goth (and golang.org/x/oauth) doesn't really care about the error, and it sends a token request with an empty authorization code to the server anyway, which always results in a `oauth2: cannot fetch token: 400 Bad Request` error from goth.
It means that unless the "state" parameter is omitted from the error response (which is required to be present, according to [RFC 6749, Section 4.1.2.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1)) or the page is reloaded (makes the session invalid), a 500 Internal Server Error page will be displayed.
This fixes it by handling the error before the request is passed to goth.

…0000)

The code introduced by go-gitea#18185 gets the error from response after it was processed by goth.

That is incorrect, as goth (and golang.org/x/oauth) doesn't really care about the error, and it sends a token request with an empty authorization code to the server anyway, which always results in a `oauth2: cannot fetch token: 400 Bad Request` error from goth.
It means that unless the "state" parameter is omitted from the error response (which is required to be present, according to [RFC 6749, Section 4.1.2.1](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1)) or the page is reloaded (makes the session invalid), a 500 Internal Server Error page will be displayed.
This fixes it by handling the error before the request is passed to goth.