Add support for Referrer Policy header

[tommy-gilligan]

See #218 for initial discussion. Forgot to check browser support before going ahead with this 😞 Maybe useful at a later date.

[oreoshake]

1. Thank you! This is great. ❤️
2. We can't apply this by default without a major version bump, in the meantime let's opt-out by default like we do for hpkp here. Even though I believe that 95% of web apps can default to this setting without issue, we just can't surprise that other 5% with broken behavior.
3. @mikewest is the referrer-policy header still a thing? I don't see it anywhere under "referrer policy delivery"

[mikewest]

Deferring to @estark37 and @jeisinger, who are much more up to date on Referrer Policy than I am.

[estark37]

Referrer-Policy is a separate header, but isn't implemented in Chrome yet (and I don't think in FF either). We'll likely deprecate the referrer directive in CSP at some point after implementing the separate header.

[oreoshake]

@tomgilligan sounds like referrer-policy will be a thing so if you can address # 2 in my previous comment we can merge this to be ready for the browser implementations.

thanks @mikewest and @estark37 😻

[estark37]

Is this supposed to be two separate strings instead of continuing the PKP-RO string?

'Public-Key-Pins-Report-Only', 'Referrer-Policy'

[oreoshake]

Good 👀, I didn't catch that.

[tommy-gilligan]

Ahh! Soz

[tommy-gilligan]

Yep, addressing # 2 and typo in railtie now.

[estark37]

Oh btw here's the link to the editor's draft that specs the separate header: https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-header

[oreoshake]

Thanks @tomgilligan!