how to include third party javascript libraries?

In this chrome CL I tried adding a third-party library for dealing with SDP in webrtc tests. I put a trimmed down version of the code, a README specifying where to obtain it and a LICENSE file into a directory under the one with the tests using it. @foolip was summoned and asked me to raise the issue here.

How should javascript libraries that are third-party be treated? "Third party" in the sense "they existed before, they are independent from wpt and someone else maintains them"

I assume fetching them from the network is off the table since there should be no runtime dependency on the network.

Should they put in a central place so they can be ignored by linters? If they are only used by a particular spec (nothing else on the web uses SDP thankfully) is a place like <spec>/resources/ better.
Should a package manager (npm, yarn, ...) be used? With or without lockfiles etc.
What is the process for updating them (e.g. npm audit)? Should local modifications be avoided?
Are there licensing concerns that need to be taken care of?

Lots of questions...
in this particular case i'm happy to use the same pattern that is used for webidl2.js

Review the linked Chromium CL and the existing resources/webidl2/lib pattern first. Define and document a decided process covering placement, dependency management, updates, local modifications, and licensing for third-party JavaScript libraries; done means the project has clear guidance that resolves these questions.