Where possible, jquery versions should be patched to address recent jquery exploit

Manually Test This Path & it works fine.

Here's a patch with all included jQuery versions patched. The tools jQuery used to minify itself in the old days no longer exist, so I compiled everything with CodeKit and copy/pasted the copyright lines from the old versions. This is entirely untested and needs to be put through its paces with all included versions.

Per @dolu on #3049071: Patch local versions of jquery? (Minor vulnerability fix):

That's what I thought initially, but using Drupal 7.66 will fix the vulnerability.
There's a new file that will override jquery's extend() function.

See: https://git.drupalcode.org/project/drupal/commit/39e2971

* This provides the Object.prototype pollution vulnerability fix to Drupal
* installations running older jQuery versions, including the versions shipped
* with Drupal core and https://www.drupal.org/project/jquery_update.

The patch is still needed for people that are not upgrading to 7.66

If you use the CDN version of JQuery is the patch still necessary?

Looking at misc/jquery-extend-3.4.0.js, any version of jQuery < 3.4.0 that uses a global object named jQuery (probably 99.9% of use cases), should get its extend method modified by the core patch, whether core's, jquery_update, or otherwise (as long as the patch loads after jQuery, which is definitely true for core and jquery_update).

If you'd like to confirm that you are patched, you can run this test code in your browser's developer tools while on your site:

jQuery.extend(true, {},
  JSON.parse('{"__proto__": {"test": true}}')
);
console.log( "test" in {} );

Output will be false if patched, true if not patched.