Fix NC34 compatibility: vendor jQuery, send CSRF token explicitly on ajax calls

Live-tested against nc01 after its auto-update jumped to NC 34.0.4:

- Nextcloud's global jQuery has been deprecated since NC19 and is no
  longer reliably present/first-loaded on NC34 (other apps like
  serverinfo hit the same issue). occweb's index.js and the vendored
  jquery.terminal (term.js) both assume a global jQuery, so ship our
  own copy (js/jquery.js, 3.7.1 from code.jquery.com) and load it
  before them in templates/index.php. Fixes a hard "jQuery is not
  defined" crash that left the terminal blank (black screen).

- With that fixed, every ajax call started failing with HTTP 412
  "CSRF check failed": core only auto-attaches the requesttoken
  header to requests made through ITS OWN globally-loaded jQuery, and
  with occweb now vendoring a separate jQuery instance that no longer
  happens. A global $.ajaxSetup() call turned out unreliable (another
  app's later jQuery load can replace window.jQuery afterwards), so
  each of the three ajax calls (SQL query, initial completion list,
  occ command execution) now sets the requesttoken header explicitly
  via OC.requestToken.

Bump max-version to 34 - actually verified working on NC 34.0.4 now,
not inherited/guessed (see the policy comment in this same file).
Version bump to 0.3.5.

appinfo/info.xml

@@ -5,7 +5,7 @@
     <name>Extended OCC Web</name>
     <summary>OCC Commands in a web terminal</summary>
     <description><![CDATA[Run OCC Commands in a web terminal]]></description>
-    <version>0.3.4</version>
+    <version>0.3.5</version>
     <licence>agpl</licence>
     <author mail="dillard.blom@ensembia.com" >Dillard Blom</author>
     <namespace>OCCWeb</namespace>
@@ -20,7 +20,7 @@
              or guessed ahead. Test against the next major's beta and bump
              this BEFORE it goes final, so occ:upgrade never has to fall back
              to auto-disabling the app. -->
-        <nextcloud min-version="30" max-version="33"/>
+        <nextcloud min-version="30" max-version="34"/>
     </dependencies>
     <navigations>
         <navigation role="admin">

js/index.js

@@ -1,6 +1,13 @@
 (function (OC, window, $, undefined) {
   'use strict';
   $(function() {
+    // Nextcloud core only auto-attaches the CSRF requesttoken header to ajax
+    // calls made through its own globally-loaded jQuery. Since NC34 that
+    // global jQuery is no longer guaranteed to be the one still active by
+    // the time our own calls fire (other apps loading their own jQuery can
+    // replace window.jQuery afterwards - see js/jquery.js), ajaxSetup() here
+    // isn't reliable; every $.ajax() call below sets the header explicitly.
+
     function scrollToBottom(){
       var html = $('html');
       html.scrollTop(html.prop('scrollHeight'));
@@ -287,6 +294,7 @@
         type: 'POST',
         contentType: 'application/json',
         timeout: SQL_REQUEST_TIMEOUT_MS,
+        headers: { requesttoken: OC.requestToken },
         data: JSON.stringify({ sql: sql, confirm: !!confirmed })
       }).done(function (response) {
         if (response && response.requiresConfirmation) {
@@ -319,7 +327,7 @@
       });
     }
 
-    $.get(baseUrl + '/cmd', function(response){
+    $.ajax({ url: baseUrl + '/cmd', headers: { requesttoken: OC.requestToken } }).done(function(response){
       $('#app-content').terminal(function(command, term) {
         if (mode === 'sql') {
           var trimmed = command.trim();
@@ -375,6 +383,7 @@
             url: baseUrl + '/cmd',
             type: 'POST',
             contentType: 'application/json',
+            headers: { requesttoken: OC.requestToken },
             data: JSON.stringify(occCommand)
           }).done(function (response) {
             term.echo('\n' + response).resume();

templates/index.php

@@ -1,4 +1,9 @@
 <?php
+// Nextcloud's global jQuery has been deprecated since NC19 and is no longer
+// reliably present on NC34+ (see e.g. serverinfo needing to bundle its own) -
+// term.js (jquery.terminal) and index.js both require jQuery to be loaded
+// first, so ship and load our own copy rather than relying on core.
+script('occweb', 'jquery');
 script('occweb', 'index');
 script('occweb', 'term');
 script('occweb', 'unix_formatting');