[Signature-based SRI] Parse metadata explicitly.

There's only one callsite (in `FetchManager`) that passes a string to
`SubresourceIntegrity::CheckSubresourceIntegrity` rather than an
`IntegrityMetadataSet`, and it's also taking responsibility for CORS
checks and error messages.

This CL shifts things such that `FetchManager` takes responsibility
for parsing a string into an `IntegrityMetadataSet`, and
`SubresourceIntegrity` takes responsibility for the eligibility checks
and errors.

As a result, we know that all metadata parsing runs through
`ParseIntegrityAttribute`, which will simplify the process of adding new
integrity types as we explore signature-based SRI.

Bug: 380783670
Change-Id: Ib3753b2f5ca58e5fdfaba5b6ff3d3b599f736a84
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6054980
Reviewed-by: Antonio Sartori <antoniosartori@chromium.org>
Commit-Queue: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1389251}