WebUI: require Subresource Integrity on external links

Also migrate to .mjs format.

PR #22263.

src/webui/www/.htmlvalidate.json

@@ -1,12 +0,0 @@
-{
-  "extends": [
-    "html-validate:recommended"
-  ],
-  "rules": {
-    "input-missing-label": "error",
-    "long-title": "off",
-    "no-inline-style": "off",
-    "no-missing-references": "error",
-    "prefer-button": "off"
-  }
-}

src/webui/www/.htmlvalidate.mjs

@@ -0,0 +1,20 @@
+import { defineConfig } from "html-validate";
+
+export default defineConfig({
+    extends: [
+        "html-validate:recommended"
+    ],
+    rules: {
+        "input-missing-label": "error",
+        "long-title": "off",
+        "no-inline-style": "off",
+        "no-missing-references": "error",
+        "prefer-button": "off",
+        "require-sri": [
+            "error",
+            {
+                target: "crossorigin"
+            }
+        ]
+    }
+});