Update bootstrap to 3.4.1

[Maxyme]

Update bootstrap to 3.4.1 to fix XSS vulnerability, CVE-2019-8331:
https://blog.getbootstrap.com/2019/02/13/bootstrap-4-3-1-and-3-4-1/

Issue reference: #6871

[lovelydinosaur]

Thanks!

@encode/django-rest-framework - we ought to validate the SHA of the .min.js against the hosted file whenever we're updating a dependency like this.

I'm happy to make time for this or to have someone else take it on - what are our thoughts (if any) on timings for the next release?

[shrew4u2do]

+1 for merging this one in

[jpadilla]

Regarding #6923 (comment), a possible approach to process here would be to have a bash script with versions/urls pointing to dependency sources. In order to update one of these dependencies, we would update the version/url and run script to download. Same script could be run in CI to compare SHAs. I could help with introducing something like this.

--

$ curl -s https://raw.githubusercontent.com/encode/django-rest-framework/d6c24df9679cad1402243e90e565fea468b5a121/rest_framework/static/rest_framework/js/bootstrap.min.js | shasum -a 256
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe  -

$ curl -s https://stackpath.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js | shasum -a 256
9ee2fcff6709e4d0d24b09ca0fc56aade12b4961ed9c43fd13b03248bfb57afe  -