Keep supported hash metadata through verification so misplaced or excess
base64 padding cannot disable integrity checks or select a weaker algorithm.
Accept matching noncanonical base64 without changing encoded metadata used
by CSP and preload consumption.
Cover script, preload, CSP, and Window/Worker fetch consumers. Validate with
cargo fmt, workspace Clippy, and all 19,886 nextest tests, plus browser
comparisons and SRI/preload WPT regressions.