Add MFE runtime loader with manifest verification and SRI

What does this MR do and why?

Part 6a of the registry-direct MFE series: the runtime loader — shipped dormant (nothing imports it yet; the first consumer is part 6b). The CSP header is this MR's only observable change.

• push_mfe_gon publishes per app: served version + its registry version-manifest checksum, the baked fallback version, and the mf-manifest path (double-flag-gated: mfe_enabled + per-surface flag).
• The loader (lib/mfe/runtime.js) loads override versions cross-origin from the registry with browser-side verification: it fetches {registry_url}/{app}/{version}/manifest.json, hashes the raw bytes against the activation-recorded checksum (crypto.subtle, or a pure-JS @noble/hashes digest on insecure origins where WebCrypto is unavailable), and only then uses it. Every registry script — MF entry and chunks — is injected with integrity + crossorigin="anonymous" derived from the verified manifest, so the whole version is hash-pinned, not just the entry.
• Any failure (fetch, checksum mismatch, SRI, mount) degrades to the baked same-origin copy with Sentry evidence; terminal failures rethrow for the consumer to handle.
• CSP: the registry origin is added to connect-src only (scheme+host+port preserved). script-src is deliberately untouched — the default policy's 'strict-dynamic' ignores host sources; trust propagates from the nonce'd host bundle to loader-injected scripts, and SRI is the compensating integrity control (rationale in code comments).

Threat model in brief: the admin records a checksum at activation; the browser refuses any manifest that doesn't hash to it; asset bytes are refused by SRI if they don't match the verified manifest. A tampered registry can only cause fallback-to-baked, never foreign code execution.

How to verify

yarn jest spec/frontend/lib/mfe spec/frontend/mfe_loader
bin/rspec spec/helpers/mfe_helper_spec.rb spec/lib/gitlab/content_security_policy/config_loader_spec.rb

Stack

#	Scope	MR
1	Config section + instance kill switch	!246732 (merged)
2	Vendor pin file + registry manifest schema + verified bake task	!246736 (closed)
3	Version overrides table + resolver	!246753 (closed)
4	Admin API + routes + sidebar	!246758 (closed)
5	Admin UI (Vue)	!246764 (closed)
6a	Runtime loader: gon contract, manifest verification + SRI, baked fallback, CSP connect-src	this MR
6b	Duo Chat consumer behind mfe_duo_chat	!246778 (closed)
7	Developer mode (local dev server + HMR)	!246833 (closed)

Related

• Phase 1 issue: #605798
• Epic: gitlab-org#22777

Related to #605798.