FEATURE: Use "no-referrer-when-downgrade" as our embed policy (PR #10940)

This allows our iframes to pass through the proper referer so that embedding continues to work in modern browsers with different security models.

GitHub