title: ASP.NET Core Script Tag Helper asp-fallback-src fails integrity check
body: <p>I'm receiving the following error when I test falling back to a local file using the ASP.NET Core Script Tag Helper:</p>
  
  <blockquote>
    <p>Failed to find a valid digest in the 'integrity' attribute for
    resource '<a href="http://localhost:48888/js/jquery.min.js" rel="noreferrer">http://localhost:48888/js/jquery.min.js</a>' with computed
    SHA-256 integrity 'oozPintQUive6gzYPN7KIhwY/B+d8+5rPTxI1ZkgaFU='. The
    resource has been blocked.</p>
  </blockquote>
  
  <p>The local file is text equal to the CDN version, but is not binary equal. This becomes a problem because the integrity hash is compared against not only the main source, but the fallback source as well, and fails the check because it generates a different hash. </p>
  
  <p>Here is an example:</p>
  
  <pre><code>&lt;script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"
      asp-fallback-src="~/js/jquery.min.js"
      asp-fallback-test="window.jQuery"
      crossorigin="anonymous"
      integrity="sha256-FgpCb/KJQlLNfOu91ta32o/NMZxltwRo8QtmkMRdAu8="&gt;
  &lt;/script&gt;
  </code></pre>
  
  <p>This works fine as long as the browser can reach the Google's CDN. But if you change source to bad value such as looking for a non-existent version such as "3.9.9" which causes it to fallback to the local file. That local file will fail to load because they are not binary equal (different hashes). </p>
  
  <p>Ideally the integrity check would not be applied to local files, since we trust a local file under our control. The alternative is that we could define a different hash for the local fallback. </p>
  
  <p>Are either of these options available? If not is there another workaround? I'm trying to avoid manually copying down from the CDN to make them match, because of the added maintenance work required for future updates. I'd like to use a package manager. </p>