HTTPSock: tighten hardening header defaults

Switch the default Referrer-Policy from same-origin to no-referrer so the
webadmin URL (which can carry user/network names in the path) does not
leak to outbound clicks either.

Drop Pragma: no-cache; it is deprecated and modern intermediaries honor
Cache-Control. Simplify Cache-Control to a single no-store directive,
which on its own already prevents storing per RFC 9111; the previous
no-cache, must-revalidate, max-age=0 tail was HTTP/1.0-era padding.

src/HTTPSock.cpp

@@ -793,7 +793,7 @@ void CHTTPSock::WriteHardeningHeaders(unsigned int uStatusId) {
     // entirely via OmitHardeningHeader, before PrintHeader runs.
     writeIfWanted("X-Frame-Options", "SAMEORIGIN");
     writeIfWanted("X-Content-Type-Options", "nosniff");
-    writeIfWanted("Referrer-Policy", "same-origin");
+    writeIfWanted("Referrer-Policy", "no-referrer");
 
     // Don't cache authenticated/dynamic responses. Skip for 304 and for
     // static asset MIME types that the ETag/Last-Modified path handles
@@ -804,9 +804,7 @@ void CHTTPSock::WriteHardeningHeaders(unsigned int uStatusId) {
         m_sContentType.StartsWith("text/css") ||
         m_sContentType.StartsWith("application/javascript");
     if (!bStaticLike) {
-        writeIfWanted("Cache-Control",
-                      "no-store, no-cache, must-revalidate, max-age=0");
-        writeIfWanted("Pragma", "no-cache");
+        writeIfWanted("Cache-Control", "no-store");
     }
 }