jq: Fix CVE-2015-8863 and CVE-2016-4074 (#18908)

jq has not had a release since v1.5 in August 2015, so backport both of
these patches (the fix for CVE-2015-8863 is in the current master, while
the fix for CVE-2016-4074 is not yet in master).