Prevent the referrer policy helper from writing past the caller buffer

[srpatcha]

eb_priv_apply_referrer can write a terminator one byte beyond the caller-provided output buffer. Bound the write correctly and add regression coverage for the boundary case.