Strip the referrer entirely on cross-origin navigation requests and iframe sub-resources

[jumde]

From: brave/brave-browser#3422

[fmarier]

Our behavior on Desktop is a bit more complicated than what can fit in the issue title, and it is also in the middle of changing.

However, currently on iOS, we don't spoof or strip the referrer in any way as can be seen on https://fmarier.github.io/brave-testing/referrer-spoofing.html.

[fmarier]

Given that we've aligned with Safari (capping the referrer to strict-origin-when-cross-origin), I think we can close this.

Would be good to give it a quick test first using the test pages we use in brave-core:

• https://fmarier.github.io/brave-testing/referrer-spoofing.html
• https://referrer.fmarier.org/redirects.html
• https://referrer.fmarier.org/samesite.html.
• https://dev-pages.brave.software/referrer/index.html
• https://fmarier.com/referrer/strict-origin.html

[jumde]

Verified on 1.23.1 - all tests look good.