Implement new referrer policies

net/url_request/url_request.h

Index: net/url_request/url_request.h
diff --git a/net/url_request/url_request.h b/net/url_request/url_request.h
index e5b06ad0c0e6535794763bb1c7a6939b11681ddd..b98b3ffe03dbbb03ab914bc945abb1d82a0b07be 100644
--- a/net/url_request/url_request.h
+++ b/net/url_request/url_request.h
@@ -105,6 +105,11 @@ class NET_EXPORT URLRequest : public base::SupportsUserData {
     // Strip the referrer down to the origin regardless of the redirect
     // location.
     ORIGIN,
+    // Clear the referrer on cross-origin redirect locations.
+    CLEAR_REFERRER_ON_TRANSITION_CROSS_ORIGIN,
+    // Strip the referrer down to the origin, but clear it entirely if the
+    // protocol changes from HTTPS to HTTP.
+    ORIGIN_CLEAR_ON_TRANSITION_FROM_SECURE_TO_INSECURE,

[mmenke, 2017/06/07 21:03:57]

These names aren't accurate - not sure if there's a way to be clearer without
making them take up 5 lines each, but it's not the transition that makes us
clear the referrer, but rather having a secure referrer and an insecure page. 
Could update the descriptions, at least.

i.e., if https://secure/ requests http://foo.com/ with policy ORIGIN,
http://foo.com/ sees the referrer, but if foo.com then changes the policy with
"strict-origin" and redirects to http://bar.com/, bar.com does not see the
referrer, even though it's not a secure to insecure transition.

There are also lots of other fun cases (secure->insecure->secure and then set a
policy that only keeps referrer on secure sites won't retroactively remove the
referrer, for instance).

[estark, 2017/06/08 18:42:57]

Updated the comments. I think it would also help to name these values to match
the spec, but perhaps that can be for a different CL.

     // Always clear the referrer regardless of the redirect location.
     NO_REFERRER,
     MAX_REFERRER_POLICY