Summary
hCaptcha's secure enclave mode supports pinning a specific version of the secure-api.js script, for which we can also use subresource integrity for verification.
Background
T403829: hCaptcha: Self-host secure-api.js code needs more time to work out how to accommodate loading the secure-api.js in ConfirmEdit and on Wikimedia hosting. In the meantime, we'll benefit from pinning the version of the secure-api.js script and ensuring that it's contents do not change from our expectations by setting the integrity parameter on the script element.
Acceptance criteria
- ConfirmEdit/hCaptcha supports specifying the integrity field for the script element of the secure-api.js script
- Wikimedia's deployment of hCaptcha has veresion pinning and subresource integrity enabled for secure-api.js