Make import statements set the importing script as the referrer

[domenic]

Fixes #1150. Previously, they would set the top-level document (that
requested the root of the module script tree) as the referrer. This
makes more sense, being for example consistent with CSS @import.

[annevk]

Okay, so the referrer is the root, but the Origin is the requester of the root? I guess that makes sense. @TanviHacks @estark37 @bzbarsky, thoughts?

The scenario here is

<script type=module src=modulescript.js>

and then modulescript.js (root) declaratively (not through script execution, so the base URL and such will be different) fetching some further resources.

This is similar to ```that has@import ...`. However, in that case CORS is not used for the URL declared by `@import`. Here it would be inherited.

[bzbarsky]

That seems reasonable to me.

[annevk]

On further reflection I think this is the most reasonable thing to do. Otherwise you get confused deputy attacks.