Change sub-resource referrer policy to report 3p origin

Currently Brave does a number of things to prevent privacy loss through the referrer header

https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)#modified-features-and-functionality

This has significant webcompat cost, which we try to mitigate with an exception list.

Since Brave made this decision, Chromium has gotten tighter with its handling of the referrer header. Basically, they have a default of strict-origin-when-cross-origin; sites who want the previous, more permissive behavior need to opt in.

To reduce the webcompat cost, but still aggressively protect user privacy, we should:

1. Use Chromium’s behavior as the default
2. Respect when sites specify a more restrictive policy (e.g. no-referrer)
3. Treat less restrictive policies as strict-origin-when-cross-origin
4. Never send referrer for insecure requests

E.g.

1. Set effective policy to strict-origin-when-cross-origin.
2. Is this a cross-site navigation?
   • GET / HEAD?
     • If yes, change effective policy to no-referrer
   • Otherwise:
     • Requested policy of origin?
       • If yes, change effective policy to strict-origin
     • Requested policy of no-referrer, same-origin, or strict-origin?
       • If yes, change effective policy to the requested policy.
3. Is this a sub-resource or iframe request?
   • Requested policy of origin?
     • If yes, change effective policy to strict-origin
   • Requested policy of no-referrer, same-origin, or strict-origin?
     • If yes, change effective policy to the requested policy.

(previously expressed as) ~* if request is HTTP -> no-referrer~ ~* elif {no-referrer-when-downgrade,unsafe-url, origin, origin-when-cross-origin} -> strict-origin-when-cross-origin~ ~* elif {no-referrer, same-origin, strict-origin} -> no change~ ~* else strict-origin-when-cross-origin~

Interaction with Shields This intervention should be tied to the cookie setting toggle in shields. When shields are down, or the cookies setting for the top level URL is “All cookies allowed”, Brave should default to Chromium behavior. When the cookie setting in shields is “Cross-site cookies blocked” or “All cookies blocked”, the policy described in this issue should apply.

[pes10k]

Manual tests for QA https://dev-pages.bravesoftware.com/referrer/index.html and https://dev-pages.brave.software/index.html (same tests, but both origins are needed for some of the tests)

[srirambv]

Verification passed on OnePlus 6T with Android 10 running 1.12.111 x64 build

• Verified test plan from brave/brave-core#5613
• Verified tests on https://fmarier.github.io/brave-testing/referrer-spoofing.html and works as expected
• Verified tests on https://referrer.fmarier.org/samesite.html and works as expected
• Verified tests on https://fmarier.com/referrer/strict-origin.html and works as expected
• Verified tests on https://referrer.fmarier.org/redirects.html and works as expected
• Verified tests on https://dev-pages.brave.software/referrer/index.html and works as expected

---

Verification passed on Samsung Tab A with Android 10 running 1.12.111 x64 build

• Verified test plan from brave/brave-core#5613
• Verified tests on https://fmarier.github.io/brave-testing/referrer-spoofing.html and works as expected
• Verified tests on https://referrer.fmarier.org/samesite.html and works as expected
• Verified tests on https://fmarier.com/referrer/strict-origin.html and works as expected
• Verified tests on https://referrer.fmarier.org/redirects.html and works as expected
• Verified tests on https://dev-pages.brave.software/referrer/index.html and works as expected