Ref T4342. By default, insert rel="noreferrer" for links. We do not insert this if:

• The caller provided an explicit "rel" attribute.
• We recognize the link as an anchor ("#comment-2"), or as local to the current domain ("/path/to/resource").

Otherwise, add it in all cases.

Added and executed unit tests. (The javascript stuff which was touched a little bit has a pile of tests already, too.)