Types of changes

• Bug fix (a non-breaking change which fixes an issue)
• New feature (a non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

1: Remove hashes for preload links
Currently, all <link rel="preload" as="script"> elements' integrity hashes are added to the CSP header's script-src directive if ssg.hashScripts is enabled, leading to unnecessarily long header lengths that are not supported by all hosts #606

According to https://groups.google.com/a/chromium.org/g/blink-dev/c/9r2SuJQuWBM/m/UcJiPfm1AgAJ prefetching is controlled by default-src, and scripts-src is only checked when the script is inserted into the page for execution.
As long as strict-dynamic is included in script-src, only the entry script (and inline scripts) need to be added to the policy, and that trust is propagated to any additional scripts that it loads.

2: Configurable hash algorithm
It seemed trivial to make the hash algorithm configurable. Tests currently rely on the default remaining SHA-256 in order to differentiate between inline (hashed with the default algorithm) and external scripts (integrity attribute with SHA-384 hash).

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes (if not applicable, please state why)