Fix automatic CSP hash update

The problem was that whenever the hashe needed an update, the current
patch would create a conflict which cannot be easily auto-resolved.

Instead, put the hashes in a separate patch that is deleted and
regenerated each time, avoiding the conflicts.

Also the web worker iframe hash was not being updated.

ci/lib.sh

@@ -85,18 +85,20 @@ run-steps() {
   while (( $# )) ; do
     local name=$1 ; shift
     local fn=$1 ; shift
+    echo "$name..."
     # Only run if an earlier step has not failed.
+    # For all failed steps, write out an empty checkbox.
     if [[ $failed == 0 ]] ; then
-      echo "$name..."
       if $fn | indent ; then
         echo "- [X] $name" >> .cache/checklist
       else
         ((failed++))
+        echo "- [-] $name" >> .cache/checklist
+        echo "Failed" | indent
       fi
-    fi
-    # For all failed steps, write out an empty checkbox.
-    if [[ $failed != 0 ]] ; then
+    else
       echo "- [ ] $name" >> .cache/checklist
+      echo "Skipped" | indent
     fi
   done
   if [[ $failed != 0 ]] ; then