For each same-origin `Link: rel=preload` directive, fetch the subresource, sign
it, compute its header-integrity, and construct a corresponding `Link:
rel=allowed-alt-sxg`. This allows subresource substitution [1], for prefetching
subresources via the Google SXG Cache [2].

Header-integrity values are cached, since fetching and signing each subresource
is expensive. If there is an error in fetching or signing, then the error
status is also cached; this reduces the traffic to the origin caused by
preloading a resource that can't be signed.

To facilitate integration with the environment:
- Added a subresource_fetcher parameter which is an implementation of Fetcher,
  but may be different from the OCSP fetcher if desired.
- Created an HttpCache trait, and provided an implementation which wraps the
  Service Workers Cache API [3], as provided by Cloudflare Workers [4].
- Added a HeaderIntegrityFetcher interface, with a default implementation that
  uses the above two. Useful in test to stub out the whole thing.

Extracted the computation of CBOR headers and MICE payload from SxgWorker into
utils::signed_headers_and_payload, for reuse in HeaderIntegrityFetcher.

Moved the requirement for status code 200 from index.ts to
signed_headers_and_payload. This also implements the requirement for fastly_compute.

In the fetchers for both cloudflare_worker and fastly_compute, add an 8MB
response body limit, after which an error is returned. In cloudflare_worker,
only attach a request body if it is non-empty; this addresses an error message
that bodies are disallowed on GET requests.

TODO: Issue these subresource fetches concurrently, to speed up processing on
cache miss.

[1] https://github.com/WICG/webpackage/blob/main/explainers/signed-exchange-subresource-substitution.md
[2] https://github.com/google/webpackager/blob/main/docs/cache_requirements.md
[3] https://developer.mozilla.org/en-US/docs/Web/API/Cache
[4] https://developers.cloudflare.com/workers/runtime-apis/cache

- Change the error from TS to be a 404 (not 406) so Rust knows to fetch from
  origin.
- Add a comment when an error response is found in the cache.
- Change name in wasmFunctions to match TS style.
- Update unsafe comment to say there's no data race.