integrity: refine Accept header handling

[woodruffw]

This tweaks the Accept handling for this endpoint in the following ways:

1. We no longer accept HTML mimetypes only to reject them later, since this results in a confused state between accept matching and the actual HTTP response
2. We use the 'identity' marker to ensure an adequate fallback when the user doesn't explicitly specify Accept
3. We now accept application/json, although this could be removed from the changeset

(NB: The main reason I added application/json is to ensure fallbacks/q-factor sorting works as expected.)

I've also added a bunch of parametrized tests to ensure that we handle various combinations/orders/q-values correctly.

See #17084.