Subresource Integrity should accept multiple checksums

### Description of the bug:

According to the Subresource Integrity (SRI) W3C document, SRIs should allow for multiple checksums to be defined in one string; separated by whitespace. The implementation must then prioritise the list of checksums and select the checksum with the strongest hash function.

- https://www.w3.org/TR/SRI/#agility

- https://www.w3.org/TR/SRI/#priority

### What's the simplest, easiest way to reproduce this bug? Please provide a minimal example if possible.

```starlark
ctx.download(
# ...
integrity = "someinvalidchecksum-abcde sha384-abcde",
)
```

Bazel should ignore `someinvalidchecksum` as it should be considered an unsupported algorithm. sha384 should be used instead.

### Which operating system are you running Bazel on?

Linux

### What is the output of `bazel info release`?

5.2.1

### If `bazel info release` returns `development version` or `(@non-git)`, tell us how you built Bazel.

_No response_

### What's the output of `git remote get-url origin; git rev-parse master; git rev-parse HEAD` ?

_No response_

### Have you found anything relevant by searching the web?

_No response_

### Any other information, logs, or outputs that you want to share?

It's clear the implementation in Bazel will only check the beginning of the string without splitting whitespace.
https://github.com/bazelbuild/bazel/blob/b598c518e4695096713885710b69fc0730da7f1f/src/main/java/com/google/devtools/build/lib/bazel/repository/downloader/Checksum.java#L51

Start with src/main/java/com/google/devtools/build/lib/bazel/repository/downloader/Checksum.java at the referenced checksum handling. Reproduce the ctx.download case with whitespace-separated integrity values, then verify that unsupported algorithms are ignored and the strongest supported checksum is selected; add or run the relevant downloader checksum tests to confirm the behavior.

Written by the indexing model from the issue text.