Merge commit '877090518682b6c77ba9bdfa0231afd56daec44d' into glitch-soc/merge-upstream

Conflicts:
- `app/models/concerns/user/has_settings.rb`:
  Not a real conflict, upstream added a setting textually close to a glitch-soc one.
  Added upstream's new setting.
- `app/views/settings/preferences/appearance/show.html.haml`:
  Not a real conflict, upstream added a setting textually close to a glitch-soc one.
  Added upstream's new setting.
- `config/routes.rb`:
  Upstream moved web app routes to `config/routes/web_app.rb`, while glitch-soc had
  an extra route.
  Moved the extra route to `config/routes/web_app.rb`.
- `spec/controllers/settings/preferences/appearance_controller_spec.rb`:
  This spec got converted to a system spec upstream.
  However, the theme setting works differently in glitch-soc, so the spec had been
  changed.
  Changed the corresponding system spec as well.

app/controllers/concerns/web_app_controller_concern.rb

@@ -7,6 +7,7 @@ module WebAppControllerConcern
     vary_by 'Accept, Accept-Language, Cookie'
 
     before_action :redirect_unauthenticated_to_permalinks!
+    before_action :set_referer_header
 
     content_security_policy do |p|
       policy = ContentSecurityPolicy.new
@@ -41,4 +42,10 @@ module WebAppControllerConcern
       end
     end
   end
+
+  protected
+
+  def set_referer_header
+    response.set_header('Referrer-Policy', Setting.allow_referrer_origin ? 'origin' : 'same-origin')
+  end
 end