[remote asset api] Clarify encoding of checksum.sri

[malt3]

The SRI specification specifically allows for more than one checksum to be part of integrity metadata (https://www.w3.org/TR/SRI/). The possible presence of more than one checksum is not immediately obvious without reading the specification, so we add a clarification.