I think the recommended Referrer-Policy header should be added by default in the Webserver config inside the Docker image
See: #450
This should be fixed in the upcoming 14.0.4 release: https://github.com/nextcloud/server/pull/11798
The header is now present in NC 15.
Most helpful comment
See: #450