Attempts to update to Select2 v4 reveal many changes that would require knock-on changes to other internal repos (and possibly by others as this is public).
This update therefore just updates Select2 to the latest v3 (which should have no breaking changes).
Also updates jQuery from v1 to v3 (hopefully no breaking changes).
Unfortunately, doesn't greatly reduce the SAST pipeline warnings #9 (closed) but closes #11 (closed)
Future: an alternative javascript library and/or a rethink of how this is templated.