fix: allow referrerpolicy on DOMPurify for YouTube

[dcshzj]

Problem

The referrerpolicy attribute is being stripped, but is required by YouTube.

Solution

Breaking Changes

• Yes - this PR contains breaking changes
• No - this PR is backwards compatible with ALL of the following feature flags in this doc

Bug Fixes:

• Add referrerpolicy as a whitelisted attribute.

Tests

• Edit any page using the markdown editor and paste the YouTube embed.
• Verify that the preview works correctly.
• Save the page, verify that the preview continues to work with the YouTube embed.

[Copilot]

Pull request overview

This PR fixes a bug where the referrerpolicy attribute was being stripped from YouTube embeds by DOMPurify, preventing proper functionality of embedded YouTube videos.

Key Changes:

• Added referrerpolicy to the DOMPurify ADD_ATTR allowlist to support YouTube embed requirements

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The addition of referrerpolicy to the allowed attributes list lacks test coverage. Consider adding a test case that verifies YouTube embeds with the referrerpolicy attribute are properly sanitized and the attribute is preserved. Other services in the same directory (e.g., RateLimiter.spec.ts, MailClient.spec.ts) have test coverage in the __tests__ directory.