Extract SRI logic into the packaged library for reuse by tpcrm-findings-scanner

[CallMarcus]

Summary

Track the relationship between this repo and CallMarcus/tpcrm-findings-scanner, and avoid divergence in the one place they overlap: SRI (Subresource Integrity) analysis.

Background

The two repos sit at different stages of the same TPCRM workflow, so they should stay separate rather than merge:

	domain-security-analyzer (this repo)	tpcrm-findings-scanner
Trigger	Run proactively on your own portfolio	A vendor raised a finding
Job	Detect posture gaps (SPF/DKIM/DMARC, subdomains, SRI, HTTPS)	Dispute / explain findings (origin vs CDN/WAF edge, compensating controls, dispute narratives)
Output	29-column metrics CSV	Evidence + response narrative

The genuine overlap is SRI: scripts/sri_parser.py here directly models SecurityScorecard's "Unsafe Implementation of Subresource Integrity" finding — which is exactly the kind of finding tpcrm-findings-scanner investigates and disputes. That logic should live in one place.

Proposed approach

Rather than merging the repos, make this one consumable as a library (ties into the PyPI packaging work in #11–#14) and have tpcrm-findings-scanner import it:

• As part of Package Structure & Configuration Setup #11, expose SRI analysis as an importable API (not just a CLI script), e.g. from domain_security_analyzer.sri import scan_url(...)
• Ensure the SRI result object captures everything the findings-scanner needs for evidence: per-resource integrity/crossorigin values, reason codes (missing integrity / bad hash prefix / mixed hashes / plain HTTP / cross-origin without crossorigin), and any restrictive Content-Security-Policy header (compensating control)
• Once published, have tpcrm-findings-scanner depend on this package instead of reimplementing SRI parsing
• Document the boundary between the two tools (detect vs dispute) in both READMEs

Notes / open questions

• A full merge would only make sense if the two codebases turn out to share substantial DNS/HTTP/edge-detection code — needs a code-level diff of tpcrm-findings-scanner to confirm (it was out of scope when this issue was filed).
• Depends on Package Structure & Configuration Setup #11 (package structure) landing first.

Priority: Low — enhancement / cross-repo hygiene, not blocking the PyPI release