Issue description

In #2649, we added an small external dependency. @Matt-Spence raised a concern about this in a comment, and I agree that if we want to use select2, we should in-source it and self-host.

A recent WH memo also requires us to avoid this:

Avoid unnecessary third-party resources: Agencies must not embed static, unchanging web assets, such as a specific version of a common and widely used code library (e.g., JavaScript, CSS, fonts) that are hosted on third-party services not under the control of the agency. Embedding static third-party assets is an outdated practice that no longer confers significant performance benefits, and it creates unnecessary security risks. This restriction only applies to static (unchanging) third-party assets and does not bar the practice of embedding dynamic third-party resources that are necessary for digital service delivery (e.g., analytics services).

I think our use of Andi on ssa.gov is justifiable, but let's remove the CSP cutout for select2.

Acceptance criteria

• Re-confirm the need for select2 at all and look at alternatives to self-hosting it
  • Alysia: "Self hosting is honestly the only easy resolution I can think of off the top of my head without googling for known alternatives. So no counterargument here. I do think I would still recommend the dev that implements this spend at least a few mins at least an hour trying to look for alternative solutions."
• Confirm the license for select2 aligns with ours
• In-source select2
• Remove select2 from our CSP exceptions
• stay within a 2 day timebox
• Add a (very small) ADR summarizing what we're doing and why. See the Slack thread for add'l content.

Additional context

Slack thread

Links to other issues

No response