Fix NC34 compatibility: vendor jQuery, send CSRF token explicitly on ajax calls

Live-tested against nc01 after its auto-update jumped to NC 34.0.4:

- Nextcloud's global jQuery has been deprecated since NC19 and is no
  longer reliably present/first-loaded on NC34 (other apps like
  serverinfo hit the same issue). occweb's index.js and the vendored
  jquery.terminal (term.js) both assume a global jQuery, so ship our
  own copy (js/jquery.js, 3.7.1 from code.jquery.com) and load it
  before them in templates/index.php. Fixes a hard "jQuery is not
  defined" crash that left the terminal blank (black screen).

- With that fixed, every ajax call started failing with HTTP 412
  "CSRF check failed": core only auto-attaches the requesttoken
  header to requests made through ITS OWN globally-loaded jQuery, and
  with occweb now vendoring a separate jQuery instance that no longer
  happens. A global $.ajaxSetup() call turned out unreliable (another
  app's later jQuery load can replace window.jQuery afterwards), so
  each of the three ajax calls (SQL query, initial completion list,
  occ command execution) now sets the requesttoken header explicitly
  via OC.requestToken.

Bump max-version to 34 - actually verified working on NC 34.0.4 now,
not inherited/guessed (see the policy comment in this same file).
Version bump to 0.3.5.

js/index.js

@@ -1,6 +1,13 @@
 (function (OC, window, $, undefined) {
   'use strict';
   $(function() {
+    // Nextcloud core only auto-attaches the CSRF requesttoken header to ajax
+    // calls made through its own globally-loaded jQuery. Since NC34 that
+    // global jQuery is no longer guaranteed to be the one still active by
+    // the time our own calls fire (other apps loading their own jQuery can
+    // replace window.jQuery afterwards - see js/jquery.js), ajaxSetup() here
+    // isn't reliable; every $.ajax() call below sets the header explicitly.
+
     function scrollToBottom(){
       var html = $('html');
       html.scrollTop(html.prop('scrollHeight'));
@@ -287,6 +294,7 @@
         type: 'POST',
         contentType: 'application/json',
         timeout: SQL_REQUEST_TIMEOUT_MS,
+        headers: { requesttoken: OC.requestToken },
         data: JSON.stringify({ sql: sql, confirm: !!confirmed })
       }).done(function (response) {
         if (response && response.requiresConfirmation) {
@@ -319,7 +327,7 @@
       });
     }
 
-    $.get(baseUrl + '/cmd', function(response){
+    $.ajax({ url: baseUrl + '/cmd', headers: { requesttoken: OC.requestToken } }).done(function(response){
       $('#app-content').terminal(function(command, term) {
         if (mode === 'sql') {
           var trimmed = command.trim();
@@ -375,6 +383,7 @@
             url: baseUrl + '/cmd',
             type: 'POST',
             contentType: 'application/json',
+            headers: { requesttoken: OC.requestToken },
             data: JSON.stringify(occCommand)
           }).done(function (response) {
             term.echo('\n' + response).resume();