fix(vendor): accept sha1-only SRI as last-resort verification in registry_fetch - #134

Click through to the see the full socket security project report page for this commit to see information about every dependency in this project.