Add rel="noopener noreferrer" to all target="_blank" links in layout.html

Every link in the theme that opens in a new tab uses target="_blank" with no rel hardening. There are seven of them in layout.html and none carries noopener or noreferrer:

Why this is low urgency but still worth doing

Reverse-tabnabbing is the classic reason to add rel="noopener", and it is not actually exploitable here: every browser released since roughly 2021 (Chrome 88+, Firefox 79+, Safari 12.1+) implies noopener for target="_blank" automatically. So this is defence in depth and a way to satisfy security linters, not a live vulnerability.

It is worth doing as one sweep rather than piecemeal, so the template is internally consistent — hardening one byline link while the one directly above it stays bare is worse than either doing all of them or none.

One decision to make

noopener is uncontroversial. noreferrer is not quite: it also strips the Referer header, so author and translator sites lose referrer attribution in their analytics, and the QuantEcon books are exactly the sort of place an author might care about that. Worth deciding explicitly whether the byline links get noopener alone and the toolbar/launch links get both, or whether all seven get both.

Note the byline links already carry rel="author" (authors only), so the added tokens go in the same space-separated list rather than a second attribute.

Raised by Copilot on #427, where it was deliberately deferred rather than fixed in a feature PR: three of the four byline links are pre-existing markup that PR only added rel="author" to, and fixing three of seven would have left the template inconsistent.

Start in layout.html at lines 266, 268, 270, 284, 408, 410, and 471, and inspect each target="_blank" link together with its existing rel attribute. Resolve the stated noopener/noreferrer policy before editing; done means all seven links are consistently hardened without losing the existing rel="author" token.