Learner and Studio views load jQuery UI 1.10.4 (apparently unused) and intro.js 0.5.0 from public CDNs #153

The recommender loads third-party libraries from public CDNs at runtime instead of shipping them with the package. From src/recommender/recommender.py on master:

• student_view (lines 995–997): jQuery UI 1.10.4 CSS and JS from //ajax.googleapis.com/ajax/libs/jqueryui/1.10.4/…, and intro.js 0.5.0 from //cdnjs.cloudflare.com/ajax/libs/intro.js/0.5.0/intro.min.js.
• studio_view (line 1031): the same jQuery UI JS from ajax.googleapis.com.

Impact:

• An air-gapped install, or one whose Content Security Policy only allows its own origins, can't run the block for learners or edit it in Studio.
• Every install sends its learners' browsers to two third parties.
• jQuery UI appears to be unused. The block's own scripts (recommender.js, recommenderstudio.js, cats.js) and templates make no jQuery UI calls (no widgets, .position(), effects or ui-* classes); the only third-party call is introJs().start(). So 1.10.4 (2014), with its published advisories (e.g. CVE-2016-7103, CVE-2021-41182/41183/41184, fixed in later releases), isn't reachable through the recommender itself. Loading it does replace $.ui for anything else sharing the page, though.
• intro.js 0.5.0 dates from 2013.

Expected: drop the jQuery UI includes (CSS and JS) from both views, and ship a current intro.js as a package static file (self.runtime.local_resource_url / resource_loader).

Environment: recommender-xblock 5.1.0 (master, pinned by openedx-platform master) and 5.0.0 (release/verawood), 2026-09-24; code as on master 2026-10-16. Found by the Open edX end-to-end test suite.