Implement cache-busting and SRI for CSS

Use Hugo's fingerprinting pipes [0] to give external stylesheets an
identifier to enable cache-busting [1].
Since Hugo's fingerprinting automatically generates the information
needed for SRI [2], include an integrity attribute too.

I discovered this feature through webhint [3], and added the .hintrc
file I used to the repo root.

[0]: https://gohugo.io/hugo-pipes/fingerprint/
[1]: https://css-tricks.com/strategies-for-cache-busting-css/
[2]: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
[3]: https://webhint.io/

.gitignore

@@ -1,2 +1,3 @@
 public/
 public_*/
+hint-report/

.hintrc

@@ -0,0 +1,43 @@
+{
+	"extends": [
+		"web-recommended"
+	],
+	"connector": {
+		"name": "puppeteer",
+		"options": {
+			"browser": "Chromium",
+			"headless": false
+		}
+	},
+	"browserslist": [
+		">.01%, last 2 versions, not dead"
+	],
+	"hints": {
+		"axe/other": "error",
+		"https-only": "error",
+		"doctype": "error",
+		"no-broken-links": "error",
+		"performance-budget": "error",
+		"compat-api/css": "error",
+		"compat-api/html": [
+			"error",
+			{
+				"ignore": [
+					"time",
+					"picture"
+				]
+			}
+		],
+		"http-compression": [
+			"warning",
+			{
+				"html": {
+					"brotli": false
+				},
+				"resource": {
+					"brotli": false
+				}
+			}
+		]
+	}
+}

themes/etch-custom/layouts/partials/head.html

@@ -17,10 +17,11 @@
 	{{ if not (eq $dark "off") -}}
 	{{ $resources = $resources | append (resources.Get "css/dark.css" | resources.ExecuteAsTemplate "dark.css" .) -}}
 	{{ end -}}
-	{{ $css := $resources | resources.Concat "css/style.css" | minify }}
+	{{ $css := $resources | resources.Concat "css/style.css" | minify | resources.Fingerprint "sha384" -}}
-	{{ printf `<link rel="stylesheet" href="%s">` $css.RelPermalink | safeHTML }}
+	{{ printf `<link rel="stylesheet" href="%s" integrity="%s">` $css.RelPermalink $css.Data.Integrity | safeHTML }}
 	{{ if .Params.highlight -}}
-	{{ printf `<link rel="stylesheet" href="/css/syntax.css">` | safeHTML }}
+	{{ $css_syntax := resources.Get "/css/syntax.css" | minify | resources.Fingerprint "sha384" }}
+	{{- printf `<link rel="stylesheet" href="%s" integrity="%s">` $css_syntax.RelPermalink $css_syntax.Data.Integrity | safeHTML }}
 	{{ end -}}
 
 	{{ if eq .RelPermalink "/" -}}