Enforce referrer-policy in WebUI

[Chocobo1]

This stops leaking private data to other websites via Referrer header.

@Piccirello
I might merge this before your other PRs, so you'll need to add the line to the new file in #9375.

[Piccirello]

Have you considered adding the ‘Referrer-Policy’ header instead? It would allow us to avoid modifying all html files.

[Chocobo1]

Have you considered adding the ‘Referrer-Policy’ header instead?

OK, will change.
Another question is, should this affect alternative webUI? I think it should restrict to built-in webUI.

[Piccirello]

I’d probably leave it enabled for the alt WebUI until someone requested otherwise (which may not happen). But we can always add another checkbox to the options 😄

[Chocobo1]

I’d probably leave it enabled for the alt WebUI until someone requested otherwise (which may not happen).

yeah, however I still think it is best not block their way in the first place, personally I would just give up and quit instead of filing an issue about it.

But we can always add another checkbox to the options

I think this is too much... I'm not trying to write a feature complete web server 😓

[Piccirello]

I think there's two options then, as I see it:

1. Include the meta tag in each html file
2. Send the header but disable it when alt webui is enabled

Edit: I see you already updated to option 2. Hadn't even noticed!

[Chocobo1]

Thanks for reviewing!