1. Strip invalid link headers (DONE in #43)

The worker should process the Link header before signing, in order to make it compatible with Google SXG Cache requirements. In particular, it should:

1. Drop all links except preload and allowed-alt-sxg.
2. Drop all links with an unsupported param name.
3. Drop all but the first 20 preloads.
4. Convert URLs from relative to absolute.
5. For any preloads without a matching allowed-alt-sxg, compute and add one.
6. (Let's not bother with imagesrcset parsing; I think we can let that be the user's responsibility.)

2. Add allowed-alt-sxg (DONE in #57 and #61)

We want to compute allowed-alt-sxg because authors won't have done this already. It is necessary to support prefetching subresources from webpkgcache.com by way of subresource substittution.

For each preload, the worker needs to:

1. Look up its URL in a header-integrity cache in the KV store.
2. If missing, fetch the URL, compute its header-integrity per this definition and store it in the cache.
   1. For a first version, set an expiry of 1 day.
   2. Ideally, use an expiry matching the subresource's cache-control header.

The KV store minimizes the # of backend fetches caused by this feature.

3. Stabilize header-integrity

Split off to #26. DONE in #36.

The worker should also eliminate frequently changing response headers that don't affect the semantics of the SXG (e.g. Date). Resources for researching which headers to eliminate:
- https://en.wikipedia.org/wiki/List_of_HTTP_header_fields#Response_fields
- https://datatracker.ietf.org/doc/html/rfc7230 and friends

4. Fix docs. (PENDING in #61)

Then the sentence at the end of #4 can be reverted.