Make "no-referrer" censor cross-document AppHistoryEntry URLs

[domenic]

Also be clear that, despite the shaky spec foundations, the intent after this fix is to expose session history entries across browsing context group swaps.

Closes #71.

---

Preview | Diff

[domenic]

I don't think we want to protect those:

• key/id are browser-generated UUIDs and not sensitive information. Prohibiting access to key would also prohibit traversal back to that entry which seems suboptimal since it'd force people to using history.go().
• index is trivially computable since x.index is just a convenience getter for to appHistory.entries().indexOf(x)
• state is something you affirmatively opt in to storing; see previous discussion in https://github.com/WICG/app-history/issues/71#issuecomment-854951702

[annevk]

I was thinking you might want to have private state just for history entries on that document. I think I'm okay with not going to those lengths though.