change referrer policy. Stop sending referers as much as possible

[hmdne]

Before this patch I managed to send a bunch of referrers to third party websites with Firefox. Unfortunately, meta name="referrer" isn't enough.
I added "noopener" because that's also what Nextcloud does. One may want to check another pull request from 2015 which may be more complete, but it was denied with a plugin proposal: #2498
References to earlier issues: #1603, #3043

[slel]

Isn't that what this plugin is for: https://github.com/ether/ep_hide_referrer

[ldidry]

@slel We shouldn’t have to use a plugin to avoid pad’s URLs leaking to third party websites.

[ldidry]

@muxator Would you consider merging this PR for 1.8.0? I think it’s important.

[muxator]

Personally, I am sensitive to the issue: my Firefox always runs with the referrer disabled, or with network.http.referer.spoofSource = true. In summary: I would prefer a more secure default like the one proposed here.

Regarding the PR: I would merge it if it was in a more complete form:

• mention somewhere in the documentation that no referrer is leaked (and that this is a change that was impelmented starting from 1.8)
• in the code & the commit message: explain what was done (at least a link to the html spec for noreferrer and noopener)
• it would also make sense, on the server side, to send the Referrer-Policy header. Something like:

  Referrer-Policy: same-origin

  edit: my original proposal was to use Referrer-Policy: strict-origin-when-cross-origin. The code that was merged with this PR used same-origin, instead, which is stricter. I accepted that version and modified the proposal.

Finally, we have to think if we want to implement this change without offering a configuration option to restore the old behaviour. I do not see a reason to do it, but you never know what's out there among your users.
Edit: let's not overcomplicate things. 1.8.0 will simply change its referrer policy.

[ldidry]

@ahmadine would you need help to comply to @muxator requested changes?

[muxator]

Gentle bump :)

[hmdne]

@slel It's already an Etherpad semantic to remove the referrers, #3044 has been merged, but Firefox seems to ignore that. This patch made Firefox remove them as well.

@muxator Of course, I will work on this patch more, this or next week. I found more places where the referrer may leak later, but this one is the most urgent.

[hmdne]

I rebased my commit on @joelpurra's work. Below I will paste the content of the commit message, because it is quite informative about the issue and I think it should be more visible to people who will be interested in that issue.

    Work towards the greatest level of referrer security.
    Pull request with discussion: https://github.com/ether/etherpad-lite/pull/3636
    
    What's already there:
    * meta name=referrer: already done in 1.6.1: https://github.com/ether/etherpad-lite/pull/3044
      https://caniuse.com/#feat=referrer-policy
      https://w3c.github.io/webappsec-referrer-policy/#referrer-policy-delivery-meta
      (Chrome>=78, Firefox>=70, Safari>=13, Opera>=64, ~IE[1], ~Edge[1])
    
    The previous two commits (by @joelpurra) I backported in this batch:
    * a rel=noreferrer: a pull request denied before: https://github.com/ether/etherpad-lite/pull/2498
      https://html.spec.whatwg.org/multipage/links.html#link-type-noreferrer
      https://developer.mozilla.org/en-US/docs/Web/HTML/Link_types
      (Firefox>=37, I can't find more info about support)
    
    This commit adds the following:
    * a rel=noopener: fixing a not-so-well-known way to extract referer
      https://html.spec.whatwg.org/multipage/links.html#link-type-noopener
      (Chrome>=49, Firefox>=52, Safari>=10.1, Opera>=36, !IE, !Edge)
    * Referrer-Policy: same-origin: the last bastion of referrer security
      https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
      (Chrome>=61, Firefox>=52, Safari>=11.1, Opera>=48, !IE, !Edge)
    
    meta name=referrer wasn't enough. I happened to leak a few referrers with my Firefox browser,
    though for some browsers it could have been enough.
    
    [1] IE>=11, Edge>=18 use a different syntax for meta name=referrer, making it most probably
        incompatible (but I may be wrong on that, they may support both, but I have no way to test
        it currently). The next Edge release will be based on Chromium, so for that the Chrome version
        applies.

[muxator]

Pulled in, thanks.