How does Drupal ensures that the one time unique URL used to reset user password does not get transferred away inside the http_referer header? For example in case the site relies on and loads some external JS (such as jQuery via CDN). Quite technical but any insights are highly appreciated. Thanks.
At this point in time, it doesn't.

There's an issue to fix this in Drupal 8, after which it will (hopefully) be ported back to 7. Patches are currently awaiting review.