vendor jsonpath-plus (#4785)

* vendor jsonpath-plus

We need the latest version (10.0.0) so that it doesn't have
vulnerabilities, but we need it to be compatible with Node.js 16.0.0, so
we needed to vendor it and make slight adjustments.

* more clarity in comment, and add the license

.eslintignore

@@ -9,3 +9,4 @@ vendor
 integration-tests/esbuild/out.js
 integration-tests/esbuild/aws-sdk-out.js
 packages/dd-trace/src/appsec/blocked_templates.js
+packages/dd-trace/src/payload-tagging/jsonpath-plus.js

LICENSE-3rdparty.csv

@@ -14,7 +14,6 @@ require,import-in-the-middle,Apache license 2.0,Copyright 2021 Datadog Inc.
 require,int64-buffer,MIT,Copyright 2015-2016 Yusuke Kawasaki
 require,istanbul-lib-coverage,BSD-3-Clause,Copyright 2012-2015 Yahoo! Inc.
 require,jest-docblock,MIT,Copyright Meta Platforms, Inc. and affiliates.
-require,jsonpath-plus,MIT,Copyright (c) 2011-2019 Stefan Goessner, Subbu Allamaraju, Mike Brevoort, Robert Krahn, Brett Zamir, Richard Schneider
 require,koalas,MIT,Copyright 2013-2017 Brian Woodward
 require,limiter,MIT,Copyright 2011 John Hurliman
 require,lodash.sortby,MIT,Copyright JS Foundation and other contributors

package.json

@@ -91,7 +91,6 @@
     "int64-buffer": "^0.1.9",
     "istanbul-lib-coverage": "3.2.0",
     "jest-docblock": "^29.7.0",
-    "jsonpath-plus": "^10.0.0",
     "koalas": "^1.0.2",
     "limiter": "1.1.5",
     "lodash.sortby": "^4.7.0",

packages/dd-trace/src/payload-tagging/index.js

@@ -5,7 +5,7 @@ const {
   PAYLOAD_TAG_RESPONSE_PREFIX
 } = require('../constants')
 
-const jsonpath = require('jsonpath-plus').JSONPath
+const jsonpath = require('./jsonpath-plus.js').JSONPath
 
 const { tagsFromObject } = require('./tagging')