feat: Implement Subresource Integrity (SRI) for CDN resources

[suciu-daniel]

Summary

Implements complete Subresource Integrity (SRI) protection for all external CDN resources to cryptographically verify that fetched resources have not been tampered with.

Changes

Phase 1 & 2: Infrastructure

• Created scripts/generate-sri-hashes.py for SHA-384 hash generation
• Created scripts/verify-sri-hashes.py for hash verification
• Added load_sri_hashes() function in admin.py
• Generated mcpgateway/sri_hashes.json with all resource hashes
• Pinned all CDN library versions (Alpine.js, Chart.js, Marked, DOMPurify)

Phase 3: Template Updates

• Added SRI to all 15 CDN resources in admin.html
• Added SRI to Font Awesome in login.html
• Added SRI to Font Awesome in change-password-required.html
• All resources include integrity and crossorigin="anonymous" attributes

Phase 4: CI Integration

• Updated make sri-verify to use verification script
• Added SRI verification step to .github/workflows/full-build-pipeline.yml
• CI fails build on hash mismatch

Phase 5: Documentation

• Updated docs/docs/architecture/adr/014-security-headers-cors-middleware.md
• Updated docs/docs/manage/securing.md
• Documented CDN library update workflow

Protected Resources (15 total)

• HTMX (1.9.10)
• Alpine.js (3.14.1)
• Chart.js (4.4.1)
• Marked (11.1.1)
• DOMPurify (3.0.6)
• CodeMirror core + 6 modes/themes (5.65.18)
• Font Awesome (6.4.0)

Security Benefits

✅ CDN Compromise Protection - Malicious code blocked
✅ MITM Attack Prevention - Tampered content detected
✅ DNS Hijacking Defense - Redirected content rejected
✅ Version Drift Detection - CI catches unexpected changes
✅ Automated Verification - Every build validates hashes

Testing

$ make sri-verify
🔐 Verifying SRI hashes against CDN content...
  Verifying htmx... ✓
  Verifying alpinejs... ✓
  Verifying chartjs... ✓
  Verifying marked... ✓
  Verifying dompurify... ✓
  Verifying codemirror_js... ✓
  Verifying codemirror_addon_simple... ✓
  Verifying codemirror_mode_javascript... ✓
  Verifying codemirror_mode_python... ✓
  Verifying codemirror_mode_shell... ✓
  Verifying codemirror_mode_go... ✓
  Verifying codemirror_mode_rust... ✓
  Verifying codemirror_css... ✓
  Verifying codemirror_theme_monokai... ✓
  Verifying fontawesome... ✓

✅ All 15 SRI hashes verified successfully!

Closes #2558

[crivetimihai]

Thanks for this solid SRI implementation, @suciu-daniel. The CI verification pipeline and centralized hash storage are well-designed. A few items:

Bug — Invalid HTML in login.html (lines 509-514 of diff)
The Font Awesome <link> tag has a broken closing. crossorigin="anonymous"> closes the tag, then /> becomes stray literal text in the page output. Compare with the correct form in change-password-required.html and admin.html. Fix: remove the extra > and close with just />.

URL mismatch for HTMX between template and hash generator
admin.html uses src="https://unpkg.com/htmx.org@1.9.10" but generate-sri-hashes.py hashes https://unpkg.com/htmx.org@1.9.10/dist/htmx.min.js. The short URL 302-redirects. Browsers compute SRI against the final response body so it may work, but this is fragile. Recommend aligning the template src to the canonical /dist/htmx.min.js path.

CDN_RESOURCES duplicated across two scripts
generate-sri-hashes.py and verify-sri-hashes.py maintain identical CDN_RESOURCES dicts. Extract to a shared module to prevent drift.

Tailwind CSS excluded but undocumented in templates
All three templates load Tailwind from CDN without SRI. The generate script has a comment explaining the JIT exclusion, but the templates have no comment. A brief <!-- No SRI: Tailwind JIT --> in each template would help maintainability.