Accept additional attributes for assets to support SRI

[ashudson23]

Summary

Potential fix for feature request in issue #344 which will add SRI integrity to be html tags before sending to client, if the value exists on the asset.

Test plan

Webpack

const SriPlugin = require('webpack-subresource-integrity');
const LoadablePlugin = require('@loadable/webpack-plugin');

module.exports = ({
  ...
  plugins: [
    ...
    new SriPlugin({
      hashFuncNames: ['sha256', 'sha384'],
    }),
    new LoadablePlugin(),
  ],
});

In the server renderer script

Also worth adding the crossorigin key (this functionality already existed and isn't being introduced by this PR)

chunkExtractor.getScriptTags({ crossorigin: 'anonymous' })

Start application

Confirm that during SSR run the tags have integrity key with correct value

<script
    async
    data-chunk="HelloWorld"
    src="/1.bundle.js"
    crossorigin="anonymous"
    integrity="sha256-mYmvbcbExknkCdg+X/j/8zsdpRcm29eJ3lpF4wfnl+4= sha384-gECBjN17ng81O/ueB9Dz8Vor95n36djp9M/oWAXg7+4qgCPArWkzSqlEchJlQK3j"
></script>

[gregberge]

It looks good but I don't get why we need to validate asset attributes.

[gregberge]

I think we will be fine without that isn't it?

[ashudson23]

Actually, you're absolute right! I was forcing loadable-stats.json to store integrity when it didn't need to be there.

[gregberge]

All of these is useless, the integrity should already be in asset. The only needed part is : getSriHtmlAttributes and all usage of it.