Adding `noopener` via JavaScript is not secure

While there is a `addNoOpener` function within the `scripts.{ts,js}` file that injects `noopener` into `a` tags, this **cannot** be trusted. Linking to this script could be forgotten, the script could fail to load, and/or client browser may not have JavaScript available or enabled.

Those unfimilure with what `rel="noopener"` does may wish to check documentation from [`web.dev`](https://web.dev/external-anchors-use-rel-noopener/) for more details.

Additionally `rel="noreferrer"` supposedly does the same thing as `noopener` while also being more privacy friendly; I believe that this should be placed on every link with `target="_blank"` to mitigate possible issues with various regions.

Start by reading the addNoOpener function in scripts.{ts,js} and inspect how links with target="_blank" are generated or modified. Check the existing link-related behavior and determine how to cover links without relying on client-side JavaScript. Done means every applicable target="_blank" link includes the requested protective rel attributes, with tests or verification updated if the repository provides them.

Written by the indexing model from the issue text.