Change referrer policy to strict-origin-when-cross-origin

Firefox will soon switch to this anyway and there should be minimal impact so it makes sense to align our requested configuration with what's possible in reality. Currently we use origin-when-cross-origin which only differs when referring to a http site.

https://bugzilla.mozilla.org/show_bug.cgi?id=1720294
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy