Add support for subresource integrity in imported module scripts

[yoavweiss]

What is the problem this feature will solve?

SRI support for ES module imports would enable using them in documents that require SRI for certain scripts for security or privacy reasons.

See problem statement by @guybedford.

HTML PR
Chromium CL + tests

What is the feature you are proposing to solve the problem?

See proposal by @guybedford.

What alternatives have you considered?

No response

[benjamingr]

@nodejs/loaders @GeoffreyBooth

(nit: ah, the irony of removing policies and landing this)

[GeoffreyBooth]

First we need to land support for import maps; there's a WIP PR for that. Then the SRI proposal for import maps needs to be accepted or at least advance to the equivalent of TC39 Stage 3. Then we can add support for it.

[guybedford]

This is a web specification, not a TC39 one - if there is question as to whether it belongs in Node.js, this is something that could potentially be brought up at the WinterCG meeting next Thursday.