Add subresource integrity for JS and CSS assets

[Gargron]

Fix #2744

[ClearlyClaire]

This breaks cross-origin loading of assets (e.g. when CDN_HOST is set). To fix that, the stylesheet_pack_tag calls need crossorigin: 'anonymous', which in turns requires the assets to be served with a Access-Control-Allow-Origin: * header.
Speaking of that last header, it seems dist/nginx.conf doesn't set those headers.

[Gargron]

Speaking of that last header, it seems dist/nginx.conf doesn't set those headers.

That config does not include anything for getting assets from a separate subdomain, so there is no reason to put that header in there. I believe the crossorigin stuff does not affect requests to the same origin.

[mashirozx]

I think we should consider adding an ON/OFF option for this. My CDN force to use a CSS, JS and HTML code minify, this caused Failed to find a valid digest in the 'integrity' attribute for resource error on browser. TAT

[Gargron]

Is there no way to disable minification in your CDN? Mastodon assets are already minified. The point of the integrity feature is to prevent the CDN from serving poisoned assets, e.g. inserting their own JS to your users without your knowledge.

A very complicated way around this would be to calculate the integrity hash for the files that your CDN serves, and put that into public/packs/manifest.json then reload mastodon-web. But, I realize this is a lot of effort for little gain.