Steps to reproduce the issue

@SharkyKZ found the reason here: #26505 (comment)

Since #25357 rendered scripts/styles have formatting added to them. But the hash is generated from scripts/styles without formatting. So the hashes don't match scripts/styles that appear on the page.

Assuming SRI works on pages with MIME type other than text/html, this was actually broken since the beginning because we wrap code in CDATA on such pages:

joomla-cms/libraries/src/Document/Renderer/Html/HeadRenderer.php

Line 231 in 56d8a35

$buffer .= $tab . $tab . '/*<![CDATA[*/' . $lnEnd;

Expected result

CSP Script hashes work

Actual result

They don't