mshtml: Fix BSTR leak in SetReferrerWithPolicy() (Valgrind).