Remove crossorigin and SRI from our static assets (CSS/JS)

[Nooshu]

Change to remove SRI on the JavaScript / CSS and remove the crossorigin attribute.

This change is part of RFC-115.

Changes have been tested on integration, seen here

[Nooshu]

I've verified that we are seeing what is expected. Using Chrome DevTools, under the Network tab there is a column called 'Connection ID'. This identifies which TCP connection the asset was loaded on. I exported a HAR file from Chrome and examined it:

124231
* HTML

124279
* CSS

124280
* Image
* CSS

124281
* Script
* Image
* CSS

124282
* Script
* Image

124283
* Script
* CSS

124284
* Image
* favicon
* CSS

124288 (anonymous connection)
* Font

124344 (anonymous connection)
* Font

Still on HTTP/1 so we are still seeing 9 TCP connections, but that is better than the 13/14 we were seeing before.

Proof that it is working is we have CSS and Scripts both coming down the same connection ID as the images. Whereas before in anonymous mode they wouldn't be able to be downloaded on the same connection as the images (since the images used a credentialed TCP connection).

Both the CSS and JS are downloading and executing as expected as seen below:

[alex-ju]

🚀