Move Referrer spoofing for .onion domains out of Torbutton

In #9623 (moved) spoofing the referrer got fixed for requests to .onion domains. We should convert that patch into a C++ one we ship with tor-browser.