SI: Downloads only protected via <a download>.

Michal Zalewski noted in [1] that we can't make meaningful promises
about integrity verification for resources interpreted as downloads
via `Content-Disposition` headers. Clever attackers have a number of
alternatives which would bypass the integrity check. He suggested
limiting the protections to `a` elements with a `download` attribute,
and further, throwing an error if `integrity` is added to any other
`a` element.

I agree.

[1]: http://lists.w3.org/Archives/Public/public-webappsec/2014Jan/0126.html