Allow public-key signatures in CSP allowed script sources

[ekobrin]

Rather than requiring a hash to be added to script-src for each script to be checked, can we add support for ed25519 public-key signatures? This way a public key could appear in script-src and a signature could accompany each script tag. This reduces the complexity of dynamically assembling pages and reduces the size of the script-src element.

[mikewest]

Let's look into something like this for CSP3. Might also be interesting for the SRI folks.

[fmarier]

Also see #449 for SRI.