External scripts with matching SRI hash should be allowed.