Added referrerpolicy as relevant mutation for img

This fixes #26388. referrerPolicy is now calls onload for image
mutations. Not all referrerPolicy attribute changes result in an image
update event. Only valid changes are reflected.

Referrerpolicy tests now pass.

components/script/dom/webidls/HTMLImageElement.webidl

@@ -27,6 +27,8 @@ interface HTMLImageElement : HTMLElement {
   readonly attribute unsigned long naturalHeight;
   readonly attribute boolean complete;
   readonly attribute USVString currentSrc;
+  [CEReactions]
+           attribute DOMString referrerPolicy;
   // also has obsolete members
 };