request_headers may send SameSite cookies cross-site

[chlily1]

If a NEL policy requests Cookie headers be sent in the request_headers report field, then SameSite cookies may be sent cross-site to a report collector.

[clelland]

Discussed at TPAC, and the sentiment in the room was that we perhaps should simply not send cookies in reports.
(Also see #112)

[yoavweiss]

Beyond that, NEL collectors in the room are currently actively stripping that information and have no use-case for it. So there's no apparent trade-off in simply removing headers from the reports.