Quoted Referrer-Policy values

For the value of the Referrer-Policy header, Mike pointed out that there
was some agreement to quote the values (`Referrer-Policy: "unsafe-url"`),
but that never actually made it into the spec. (My bad.) See
https://github.com/w3c/webappsec-referrer-policy/issues/65.

I would like to do this to be forwards-compatible in case we later want to
introduce a more flexible JSON based-syntax. Mozilla folks, are you
willing/able to consider changing the Firefox implementation?

Thanks,
Emily