SI: Drop 'CH-Integrity'.

mnot rightly notes that `Cache-Control` headers may be sent with
requests. We should certainly use that mechanism rather than
inventing a new one.
SI: Rework introduction.
SI: Blacklist `WWW-Authenticate` and `Refresh`.

* Resources hidden behind login (`WWW-Authenticate`) aren't public,
  and should be excluded from integrity checks for the same reason
  other non-public resources are excluded.

  This patch explicitly excludes `WWW-Authenticate`, and resources
  which return a 401 status code.

* Adding `Refresh` to IFrame contents would bypass the integrity
  check (e.g. `Refresh: 0;URL=javascript:...`).
SI: Add ABNF grammar for integrity metatata.
SI: Consider impact of other headers.
SI: Break out HTMLElement interface changes.
SI: Stub out unwritten element sections.
SI: s/.todo/.issue/g
SI: s/nuurl/niurl/g
SI: Remove last .todo class.
SI: Rebuilding HTML.