Add clarifying comment and a Changelog entry.

CHANGELOG

@@ -3,6 +3,7 @@ Please view this file on the master branch, on stable branches it's out of date.
 v 8.10.0 (unreleased)
   - Wrap code blocks on Activies and Todos page. !4783 (winniehell)
   - Fix MR-auto-close text added to description. !4836
+  - Implement Subresource Integrity for CSS and JavaScript assets. This prevents malicious assets from loading in the case of a CDN compromise.
 
 v 8.9.0
   - Fix builds API response not including commit data

app/views/layouts/_head.html.haml

@@ -30,6 +30,9 @@
 
   = javascript_include_tag "application", integrity: true
 
+  -# FIXME: SRI doesn't apply to the dynamically-generated per-page
+  -# JavaScript due to a bug in sprockets-rails.
+  -# See https://github.com/rails/sprockets-rails/issues/359
   - if page_specific_javascripts
     = javascript_include_tag page_specific_javascripts, {"data-turbolinks-track" => true}