use integrity attribute for javascripts from CDN

[stevepiercy]

Our scaffolds and possibly other items reference jQuery without an integrity attribute. From http://jquery.com/download/#jquery-39-s-cdn-provided-by-maxcdn

The jQuery CDN supports https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity (SRI) which allows the browser to verify that the files being delivered have not been modified. This https://www.w3.org/TR/SRI/ is currently being implemented by browsers. Adding the new integrity attribute will ensure your application gains this security improvement as browsers support it.

<script
   src="https://code.jquery.com/jquery-1.12.3.min.js"
   integrity="sha256-aaODHAgvwQW1bFOGXMeX+pC4PZIPsvn2h1sArYOhgXQ="
   crossorigin="anonymous"></script>

[ztane]

... and the important thing is to remember to change these integrity stamps as you update versions.

It happened to me that I copied these integrity stamps verbatim from getbootstrap.com, worked for me (on Firefox) and failed spectacularly then on customer's Chrome :D

[ikolar]

Working on it ...

[fangpenlin]

I can handle this

[stevepiercy]

So... I hate to say this and I apologize for not stating this up front, but things have changed since this issue was created and I did not provide a complete description:

• scaffolds are deprecated in favor of cookiecutters (the submitted changes to the scaffolds are still acceptable)
• the three supported cookiecutters should also be updated:
  • https://github.com/Pylons/pyramid-cookiecutter-starter
  • https://github.com/Pylons/pyramid-cookiecutter-alchemy
  • https://github.com/Pylons/pyramid-cookiecutter-zodb
• an update to scaffolds/cookiecutters requires an update to documentation that uses source files, specifically every tutorial step. For example, a quick search for <script src="//oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script> found 25 instances in 25 files

If you could also update all those places, then I'd prefer to merge all the PRs in one swoop. Thank you!

[fangpenlin]

it's all good, let me try to fix them all at once