fix(core): SHA256 hash for JS scripts CSP on Windows (#14265)

* fix(core): SHA256 hash for JS scripts CSP on Windows

we hash JS scripts as SHA256 for the Content-Security-Policy (CSP) header. The isolation pattern is broken on Windows due to the hash including carriage return characters, which are not processed when the webview checks the script hash to see if the CSP allows the script.

* fmt, clippy