Enable HTTP security header referrer-policy no-referrer-when-downgrade
Enable HTTP security header referrer-policy no-referrer-when-downgrade

Enable the new HTTP security header "referrer-policy", and
set it to the lax setting 'no-referrer-when-downgrade'.
This setting is a W3C Candidate Recommendation, 26 January 2017;
see <https://www.w3.org/TR/referrer-policy/>.

This means that if anyone follows a link from our site to a
non-HTTPS site, the referrer information won't leak to anyone,
including to anyone else who can see the unencrypted request.
As a result third parties who can see the unencrypted HTTP request
won't see exactly what page the user was previously viewing or any URL
parameters.  The latter isn't a big deal for our site, because we don't
intend to include security-relevant information in origin URLs anyway,
but this header provides protection just in case.

This isn't a significant improvement in security or privacy for us,
since the data is public anyway, but it's trivial to add, and in general
we want to maximize our "generic hardening" settings to make the site
harder to attack in general.

This setting was recommended by <https://securityheaders.io/>.

More information:
<https://scotthelme.co.uk/a-new-security-header-referrer-policy/>.

Signed-off-by: David A. Wheeler <9ae72d22d8b894b865a7a496af4fab6320e6abb2@dwheeler.com>

jdossett/cii-best-practices-badge,taylorcoursey/cii-best-practices-badge,yannickmoy/cii-best-practices-badge,wanganyv/cii-best-practices-badge,wanganyv/cii-best-practices-badge,coreinfrastructure/best-practices-badge,yannickmoy/cii-best-practices-badge,coreinfrastructure/best-practices-badge,taylorcoursey/cii-best-practices-badge,wanganyv/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,jdossett/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,taylorcoursey/cii-best-practices-badge,coreinfrastructure/best-practices-badge,jdossett/cii-best-practices-badge,yannickmoy/cii-best-practices-badge,yannickmoy/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,jdossett/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,taylorcoursey/cii-best-practices-badge,coreinfrastructure/best-practices-badge,wanganyv/cii-best-practices-badge