[Backport 14.7] Secure target="_blank" links by default using the HTML-Processor

A common vulnerability regarding <a> elements with a _blank target (open in new window/tab) is to forget to set the "rel" attribute with value noopener and noreferrer. Also see https://web.dev/external-anchors-use-rel-noopener/

We could fix this in CKEditor, (which was attempted somewhat sometime ago https://groups.google.com/g/hippo-community/c/n2XLSjPMWXs/m/bkAglRuuBQAJ) but I think it is way easier to make this a feature of the HTML-Processor service.

Since it should be a very concise decision to not want to use the noopener and noreferrer "rel" attribute values in case of a target="_blank" link, we can safely introduce this as the default behavior and allow the user to disable it explicitly using configuration.