[YouTubeVideo] requires `Referrer-Policy` header of the response to be set to `strict-origin-when-cross-origin`

[birdofpreyru]

i.e. res.append('Referrer-Policy', 'strict-origin-when-cross-origin') (or some alternative way to set it). Without it the embedded YouTube player refuses to load now, and reports player misconfiguration.

This should be documented; and also we probably should check it runtime and fire warnings for developer?