[kvinwang]

Problem

The /api-docs page (mounted by dstack-vmm) loads swagger-ui-dist@5 from jsDelivr with no integrity attribute, so the version floats within major 5 and any CDN or npm-package compromise runs script on a page that shares an origin with the VMM API.

Fix

Pin swagger-ui-dist@5.32.15 (last of the 5.32 line, published 2026-09-04, so it has had time in the wild) and add integrity + crossorigin="anonymous" to the CSS and both scripts. The SRI hashes are computed from the files in the npm tarball (whose sha512 matches the registry's integrity), and match what jsDelivr serves.

SwaggerUiConfig::swagger_ui_dist is removed: the hashes now pin specific files at a specific version, so a free-form base URL could only point at those same files, and the only caller (vmm/src/openapi.rs) uses the default anyway.

Verification

• cargo test -p ra-rpc --all-features passes; cargo clippy -p ra-rpc -p dstack-vmm --all-features -- -D warnings -D clippy::unwrap_used -D clippy::expect_used clean.
• Rendered the generated HTML in headless Chromium (Playwright chrome-headless-shell 1248) against the live CDN: Swagger UI loads and renders a spec, no integrity errors. With one hash altered, Chromium blocks the script ("Failed to find a valid digest in the 'integrity' attribute") and the UI does not render.