FIX: remove duplicate referrer policy

Rails already ships with strict-origin-when-cross-origin, no need
to also add no-referrer-when-downgrade

see: https://meta.discourse.org/t/harden-referrer-policy-header/100172

config/nginx.sample.conf

@@ -261,7 +261,6 @@ server {
   }
 
   location @discourse {
-    add_header Referrer-Policy 'no-referrer-when-downgrade';
     proxy_set_header Host $http_host;
     proxy_set_header X-Request-Start "t=${msec}";
     proxy_set_header X-Real-IP $remote_addr;