fix(vendor): accept sha1-only SRI as last-resort verification in registry_fetch #393

Job	Run time
clippy	27s
coverage	21m 30s
e2e-docker (gem)	4m 45s
e2e-docker (golang)	4m 11s
e2e-docker (cargo)	4m 3s
setup-matrix (golang)	2m 59s
setup-matrix (deno)	3m 15s
e2e-docker (composer)	4m 19s
lint-ecosystems	9s
e2e-docker (deno)	4m 27s
coverage-docker (deno)	5m 29s
e2e-docker (maven)	4m 57s
test-release	27m 35s
e2e-docker (npm)	4m 22s
test (windows-latest)	14m 22s
setup-matrix (nuget)	3m 28s
test (ubuntu-latest)	22m 21s
setup-matrix (cargo)	3m 33s
setup-matrix (composer)	3m 26s
test (macos-latest)	16m 20s
setup-matrix (maven)	4m 36s
setup-matrix (pypi)	4m 36s
e2e-docker (nuget)	4m 19s
coverage-docker (gem)	5m 45s
coverage-docker (composer)	5m 27s
coverage-docker (cargo)	5m 31s
coverage-docker (nuget)	5m 54s
coverage-docker (npm)	5m 38s
e2e-docker (pypi)	4m 45s
setup-matrix (gem)	3m 20s
coverage-docker (golang)	5m 31s
coverage-docker (pypi)	5m 35s
dispatch-tests	9s
coverage-docker (maven)	5m 50s
setup-matrix (npm)	4m 17s
coverage-merge	27s
e2e (ubuntu-latest, e2e_golang)	36s
e2e (ubuntu-latest, e2e_composer)	35s
e2e (ubuntu-latest, e2e_maven)	36s
e2e (macos-latest, e2e_safety_cargo_build)	48s
e2e (ubuntu-latest, e2e_vendor_gem_build)	44s
e2e (ubuntu-latest, e2e_safety_cargo_build)	36s
e2e (ubuntu-latest, e2e_safety_pnpm)	49s
e2e (ubuntu-latest, e2e_vendor_composer_build)	52s
e2e (macos-latest, e2e_safety_pnpm)	52s
e2e (ubuntu-latest, e2e_cargo)	34s
e2e (windows-latest, e2e_safety_pnpm)	1m 49s
e2e (ubuntu-latest, e2e_nuget)	40s
e2e (windows-latest, e2e_safety_cargo_build)	1m 46s
	3h 58m 55s

Provide feedback