most of our customers do not add ESD diodes on JTAG pins because each GPIO (including JTAG signals) has internal ESD protection diode. See the datasheet for more information. I would just recommend to add external pull down resistor (~10k) on JCOMP signal which keeps the JTAG module in reset when debug probe is not connected and you can also add pull up resistors on TMS, TDI and TCK pins.
