Enable SRI only for same origin and CORS content.

Source/core/fetch/Resource.h

Index: Source/core/fetch/Resource.h
diff --git a/Source/core/fetch/Resource.h b/Source/core/fetch/Resource.h
index 3cbb4c016a3ea529aeb35cb8c316373cfe7596a6..48ab91cee3f4f6f9a4d1b9dc7fe4dd3f7835d238 100644
--- a/Source/core/fetch/Resource.h
+++ b/Source/core/fetch/Resource.h
@@ -176,8 +176,10 @@ public:
     void finish();
 
     // FIXME: Remove the stringless variant once all the callsites' error messages are updated.
-    bool passesAccessControlCheck(ExecutionContext*, SecurityOrigin*);
-    bool passesAccessControlCheck(ExecutionContext*, SecurityOrigin*, String& errorDescription);
+    bool passesAccessControlCheck(ExecutionContext*, SecurityOrigin*) const;
+    bool passesAccessControlCheck(ExecutionContext*, SecurityOrigin*, String& errorDescription) const;
+
+    bool isEligibleForIntegrityCheck(ExecutionContext*) const;
 
     void clearLoader();