fix: omit integrity hashes for local vendor plugins

[pivaldi]

fix: omit SRI for local vendor assets

Problem

When vendors.plugins: local, the theme emits the hardcoded integrity
hashes from _vendors.yml on self-hosted vendor <link>/<script> tags.
Those hashes are computed for the CDN builds. As soon as the locally
bundled files differ byte-for-byte from the CDN build the hash was computed
for. For example when the vendor library is updated independently of the theme,
the browser's Subresource Integrity check fails, blocks every vendor asset,
and the page renders blank.

Fix

Subresource Integrity only adds value for cross-origin CDN assets, where
it protects against a compromised third party. Self-hosted (local) files are
served same-origin, so SRI provides little benefit there and is exactly what
breaks.

So in local mode we simply drop integrity (and crossorigin) instead
of carrying a hash that can mismatch:

     vendors[key] = {
       url      : links[plugins] || links.cdnjs,
-      integrity: value.integrity
+      integrity: plugins === 'local' ? undefined : value.integrity
     };

The next_vendors helper already omits both attributes when the hash is
absent, so no other change is needed. CDN modes are unaffected — they keep
using the hardcoded _vendors.yml hashes.

Notes

• No plugin change required. This supersedes the earlier approach in feat: use calculated integrity hashes for local vendor plugins #947
  that computed hashes via @next-theme/plugins, so the dependency on
  Update dependencies and calculate correct integrity hashes for local files plugins#347 is dropped.
• Touches a single file: scripts/events/lib/vendors.js.
• Replaces feat: use calculated integrity hashes for local vendor plugins #947 (the lazy-CSS change from that PR is split into a separate PR).

Testing

• vendors.plugins: local with vendor versions that differ from the CDN
  hashes: assets now load (previously blank page); generated tags carry no
  integrity/crossorigin.
• vendors.plugins: cdnjs (and other CDN providers): unchanged — integrity
  and crossorigin still emitted from _vendors.yml.

[CLAassistant]

All committers have signed the CLA.

[coveralls]

Coverage Report for CI Build 28303488568

Coverage remained the same at 97.451%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	405
Covered Lines:	400
Line Coverage:	98.77%
Relevant Branches:	105
Covered Branches:	97
Branch Coverage:	92.38%
Branches in Coverage %:	Yes
Coverage Strength:	3.63 hits per line

---

💛 - Coveralls

[welcome]

Congrats on merging your first pull request here! 🎉 How awesome!