Commit Alpine.js to the repo instead of unpacking it at build time (closes #163)

static/js/alpine.min.js is now committed: package/dist/cdn.min.js from
the @alpinejs/csp 3.14.9 npm package, byte for byte, taken once from the
package file that was in 3p/. The build no longer unpacks it, so
script/assets, the assets make target, its Dockerfile steps and the
ignore entries for the file are gone, and so is the package file.
Prettier and ESLint both ignore the file, so it stays as published.
Comments and the README now describe the committed file.

Model: opus-5-5

README.md

@@ -689,8 +689,9 @@ checkout, or `VERSION` when that is set. It is shown at
 
 The pages use one third-party script, Alpine.js. They load `@alpinejs/csp`, the
 version of it that works when the Content-Security-Policy forbids running text
-as code. The npm registry is where JavaScript packages are published. The
-package file in `3p/` is byte for byte the one the npm registry publishes.
+as code. The npm registry is where JavaScript packages are published.
+`static/js/alpine.min.js` is committed byte for byte as the npm registry
+publishes it.
 
 A headless browser is a browser without a window. A browser test in
 `internal/server` loads the pages in one under the real Content-Security-Policy.
@@ -710,7 +711,6 @@ application are under [Entrypoint URLs](#entrypoint-urls).
 - `script/bootstrap` installs git, make, Go and the Go modules.
 - `script/setup` runs `script/bootstrap`, then `script/install-precommit`.
 - `script/projectname` prints `webhooker`.
-- `script/assets` extracts Alpine.js from `3p/` to `static/js/alpine.min.js`.
 - `script/test` runs the tests in Docker.
 - `script/test-browser` runs the browser test in Docker.
 - `script/lint` runs `gofmt`, `golangci-lint` and ESLint in Docker.