Potential XSS in jquery.form.js

Background information

This was originally reported as a private security issue, but has been approved for handling in the public queue by the Drupal Security Team.

• security.drupal.org private issue: https://git.drupalcode.org/security/185095-drupal-security/-/work_items/1
  (included for reference. Please do not report access denied as an error.)

Problem/Motivation

The resetForm() method provided by jquery-form is vulnerable to XSS if it is used on a label element and an attacker can control the value of the for attribute of this element.

It passes the value of this attribute to $() without making sure it does not contain HTML:

			case 'label':
				var forEl = $(el.attr('for'));

Steps to reproduce

{{ attach_library('core/internal.jquery.form') }}
<label id="label" for="&lt;img src=x onerror=alert()&gt;">Label</label>
<script>
  window.addEventListener('load', function() {
    jQuery('#label').resetForm();
  });
</script>

Proposed resolution

Drupal never uses resetForm() and the library is internal (#3293156: core/jquery.form library deprecated) so it should not be used by contrib.
The solution could be to remove resetForm() entirely since we don't use it.

Remaining tasks

User interface changes

Introduced terminology

API changes

Data model changes

Release notes snippet