* noopener for all _target=blank links. Security for untrusted links,
possible minor performance improvement for internal links.
While reviewing, also checked
* nofollow on user provided links
* noreferrer only as defense in depth for links that can appear in
unpredictable locations. Will consider Referrer-Policy for everything
else.