Implement SRI on external scripts

[budparr]

Currently we only use Fathom as an external script and it can't use SRI owing to its CORS policy.

https://www.srihash.org/, enter https://cdn.usefathom.com/script.js

The URL does not support Cross-Origin Resource Sharing (CORS), when it should send a response header like Access-Control-Allow-Origin: *

I'm writing to them to ask if this is possible.

[budparr]

I have reached out to Fathom and SRI is on their roadmap. They did not give a timeline. I've determined it's not possible to hash the script ourselves because of Fathom's CORS policy.