Allow "same-origin" as "Referrer-Policy"

Fixes #11531

Although "same-origin" is more strict than e.g. strict-origin it showed up a warning in setupcheck
Based on https://scotthelme.co.uk/a-new-security-header-referrer-policy/



Signed-off-by: Moritz Beck <git@birkenstab.de>