Built files in _observablehq, _import, and _npm can change content without changing their name

[mbostock]

Framework tries to maintain the contract (via content hashes and exact versions) that built files in _observablehq, _import, and _npm should change their name if their content changes, allowing immutable caching in the browser for better performance. However, in practice, this contract can be broken for several reasons.

1. Files in _observablehq can change between Framework releases, and because they bake-in the resolved versions of npm dependencies (such as via the recommended libraries and FileAttachment APIs).
2. Files in _import can change because they bake-in the resolved versions of npm dependencies, and these resolved versions are not considered as part of the content hash (which only considers the original path of the import, pre-resolution, such as npm:@observablehq/plot).
3. Files in _npm can change because they bake-in the resolved versions of (transitive) npm dependencies. For example, @observablehq/plot depends on d3, and the version of d3 can change independently of @observablehq/plot.

To maintain this contract, Framework will need to apply hashes (or other unique identifiers) to both _observablehq and _npm, and also fix how the hash is computed in _import.