docs: pin the verify widget at 0.4.0 with SRI + crossorigin

The demo and README previously loaded a moving @latest with no
integrity check — contradicting the widget's own guidance.

Auths-Id: did:keri:ELv6uW2irGkclnFq8lAsAexmoLwZ-3k-ocwjpFBZsIEG
Auths-Device: did:keri:ELv6uW2irGkclnFq8lAsAexmoLwZ-3k-ocwjpFBZsIEG

Author: bordumb

README.md

@@ -25,7 +25,10 @@ The `<auths-verify>` web component performs cryptographic verification entirely
 **Add to any HTML page:**
 
 ```html
-<script type="module" src="https://unpkg.com/@auths-dev/verify/dist/auths-verify.mjs"></script>
+<script type="module"
+        src="https://unpkg.com/@auths-dev/verify@0.4.0/dist/auths-verify.mjs"
+        integrity="sha384-C6a5GCsPgw/o9tmtnaUXZ0qJgY/q8LdNxvuP/10EwOK39ZdiAcYz6CP8lT6m1V5R"
+        crossorigin="anonymous"></script>
 
 <!-- Compact badge -->
 <auths-verify repo="your-org/your-repo" forge="github" mode="badge"></auths-verify>

docs/index.html

@@ -4,7 +4,10 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>Auths Verification Demo</title>
-    <script type="module" src="https://unpkg.com/@auths-dev/verify/dist/auths-verify.mjs"></script>
+    <script type="module"
+            src="https://unpkg.com/@auths-dev/verify@0.4.0/dist/auths-verify.mjs"
+            integrity="sha384-C6a5GCsPgw/o9tmtnaUXZ0qJgY/q8LdNxvuP/10EwOK39ZdiAcYz6CP8lT6m1V5R"
+            crossorigin="anonymous"></script>
     <style>
         * { box-sizing: border-box; margin: 0; padding: 0; }
         body {