Components.AI: Define link and HTML safety for model-generated rich content

### Is your feature request related to a problem? Please describe the problem.

Model-generated links and HTML-like nodes create navigation, opener, and injection risks without a documented policy.

### Describe the solution you'd like

Define and enforce link target/`rel` defaults, supported URI schemes, HTML-node behavior, and the sanitization responsibility boundary between parser, application, and renderer. Document unsafe extension points clearly.

### Additional context

Leaf task for #68227 requirement J5.

Start with parent requirement #68227, requirement J5, and trace where parser, application, and renderer responsibilities are defined. Determine the existing entry points and tests for model-generated links and HTML-like nodes; done means the safety policy is enforced, unsafe extension points are documented, and coverage verifies the stated defaults and supported schemes.

Written by the indexing model from the issue text.