chore: resolve jQuery devDependency CVE

[ncoden]

Description

Update the internal jQuery version (used for tests) to the latest version to resolve a CVE.

Motivation and Context

This PR resolved a jQuery common vulnerability affecting jQuery < 3.

As Foundation supports jQuery >=2.2.0, the jQuery peer dependency is not changed. PeerDependencies versions in package.json should only reflect the actual compatibility with the package, regardless of promotion or "potential" security issue. It's up to the end developer to choose the package version corresponding to its own needs and to the risks comming with its own usage.

Types of changes

• Documentation
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing
  functionality to change)

Checklist (all required):

• I have read and follow the CONTRIBUTING document.
• There are no other pull request similar to this one.
• The pull request title is descriptive.
• The template is fully and correctly filled.
• The pull request targets the right branch (develop or support/*).
• My commits are correctly titled and contain all relevant information.
• My code follows the code style of this project.
• I have updated the documentation accordingly to my changes (if relevant).
• I have added tests to cover my changes (if relevant).
• All new and existing tests passed.

[DanielRuf]

Didn't we explicitely set it to 2+ to prevent issues with old setups? And to me it does not seem to be a peerDependency.

[ncoden]

Foundation is compatible with jQuery 2.2.0+ so we rollbacked to >=2.2 for peerDependencies (and dependencies before). We also needed jQuery in devDependencies for development mode (and tests), as peerDependencies are not installed with npm install. However, as we only use this version for internal tests, we don't care about the "real compatibility range". It only matters for peerDependencies.

Anyway with >=2.0.0, npm and Yarn will install the latest compatible version 3.3.1. That's why there is no changes in the lockfiles, we're not changing the actual jQuery version used for test, just the range to prevent an unsecure jQuery version (< 3) to be installed and make dependency watchers happy.

Related to:

• jQuery and what-input should be peerDependencies #11290 jQuery and what-input should be peerDependencies
• chore: move jQuery & what-input to peerDependencies #11290 #11294 chore: move jQuery & what-input to peerDependencies