Referrer header cleanup.

* Don't keep a separate m_outgoingReferrer on FrameLoader, just strip sensitive information off the Document::url() when the referrer is requested.
* Store a Document instead of a SecurityOrigin on FrameLoadRequest. This allows...
* Always call FrameLoader::setReferrerForFrameRequest(), but only consider using this FrameLoader's outgoing referrer if the associated Document initiated the request. This allows us to correctly enforce referrer restrictions, which ensuring we don't accidentally set a referrer from the wrong frame.

BUG=none

Review URL: https://codereview.chromium.org/113273002

git-svn-id: svn://svn.chromium.org/blink/trunk@163800 bbb929c8-8fbe-4397-9dbb-9b2b20218538