Explicitly add rel="noreferrer" to all external links

Summary: See D19117. Instead of automatically figuring this out inside `phutil_tag()`, explicitly add rel="noreferrer" at the application level to all external links.

Test Plan:
- Grepped for `_blank`, `isValidRemoteURIForLink`, checked all callsites for user-controlled data.
- Created a link menu item, verified noreferrer in markup.
- Created a link custom field, verified no referrer in markup.
- Verified noreferrer for `{nav href=...}`.

Subscribers: PHID-OPKG-gm6ozazyms6q6i22gyam

Differential Revision: https://secure.phabricator.com/D19118

src/applications/auth/view/PhabricatorAuthAccountView.php

···
           array(
             'href' => $account_uri,
             'target' => '_blank',
+            'rel' => 'noreferrer',
           ),
           $account_uri);
       }

src/applications/calendar/import/PhabricatorCalendarICSURIImportEngine.php

···
         array(
           'href' => $uri,
           'target' => '_blank',
+          'rel' => 'noreferrer',
         ),
         $uri);
     }

src/applications/files/markup/PhabricatorImageRemarkupRule.php

···
     $defaults = array(
       'uri' => null,
       'alt' => null,
-      'href' => null,
       'width' => null,
       'height' => null,
     );
···
 
     $args += $defaults;
 
-    if ($args['href'] && !PhabricatorEnv::isValidURIForLink($args['href'])) {
-      $args['href'] = null;
-    }
-
     if ($args['uri']) {
       $src_uri = id(new PhutilURI('/file/imageproxy/'))
         ->setQueryParam('uri', (string)$args['uri']);
···
         array(
           'src' => $src_uri,
           'alt' => $args['alt'],
-          'href' => $args['href'],
           'width' => $args['width'],
           'height' => $args['height'],
-          ));
+        ));
       return $this->getEngine()->storeText($img);
     } else {
       return $matches[0];

src/applications/harbormaster/artifact/HarbormasterURIArtifact.php

···
       array(
         'href' => $uri,
         'target' => '_blank',
+        'rel' => 'noreferrer',
       ),
       $name);
   }

src/applications/nuance/item/NuanceGitHubEventItemType.php

···
         'a',
         array(
           'href' => $event_uri,
+          'target' => '_blank',
+          'rel' => 'noreferrer',
         ),
         $event_uri);
     }

src/applications/phurl/remarkup/PhabricatorPhurlLinkRemarkupRule.php

···
         array(
           'href' => $uri,
           'target' => '_blank',
+          'rel' => 'noreferrer',
         ),
         $name);
     }

src/applications/search/menuitem/PhabricatorLinkProfileMenuItem.php

···
       ->setHref($href)
       ->setName($name)
       ->setIcon($icon_class)
-      ->setTooltip($tooltip);
+      ->setTooltip($tooltip)
+      ->setRel('noreferrer');
 
     return array(
       $item,

src/infrastructure/customfield/standard/PhabricatorStandardCustomFieldLink.php

···
 
     return phutil_tag(
       'a',
-      array('href' => $value, 'target' => '_blank'),
+      array(
+        'href' => $value,
+        'target' => '_blank',
+        'rel' => 'noreferrer',
+      ),
       $value);
   }
 

src/view/layout/PhabricatorActionView.php

···
       } else {
         if ($this->getOpenInNewWindow()) {
           $target = '_blank';
+          $rel = 'noreferrer';
         } else {
           $target = null;
+          $rel = null;
         }
 
         if ($this->submenu) {
···
             'href'  => $this->getHref(),
             'class' => 'phabricator-action-view-item',
             'target' => $target,
+            'rel' => $rel,
             'sigil' => $sigils,
             'meta' => $this->metadata,
           ),

src/view/phui/PHUIListItemView.php

···
   private $actionIcon;
   private $actionIconHref;
   private $count;
+  private $rel;
 
   public function setOpenInNewWindow($open_in_new_window) {
     $this->openInNewWindow = $open_in_new_window;
···
     return $this->openInNewWindow;
   }
 
-    public function setHideInApplicationMenu($hide) {
+  public function setRel($rel) {
+    $this->rel = $rel;
+    return $this;
+  }
+
+  public function getRel() {
+    return $this->rel;
+  }
+
+  public function setHideInApplicationMenu($hide) {
     $this->hideInApplicationMenu = $hide;
     return $this;
   }
···
         'meta' => $meta,
         'sigil' => $sigil,
         'target' => $this->getOpenInNewWindow() ? '_blank' : null,
+        'rel' => $this->rel,
       ),
       array(
         $aural,

src/view/phui/PHUITagView.php

···
       $classes[] = 'phui-tag-'.$this->border;
     }
 
+    $attributes = array(
+      'href' => $this->href,
+      'class' => $classes,
+    );
+
+    if ($this->external) {
+      $attributes += array(
+        'target' => '_blank',
+        'rel' => 'noreferrer',
+      );
+    }
+
     if ($this->phid) {
       Javelin::initBehavior('phui-hovercards');
 
-      $attributes = array(
-        'href'  => $this->href,
+      $attributes += array(
         'sigil' => 'hovercard',
-        'meta'  => array(
+        'meta' => array(
           'hoverPHID' => $this->phid,
         ),
-        'target' => $this->external ? '_blank' : null,
-      );
-    } else {
-      $attributes = array(
-        'href'  => $this->href,
-        'target' => $this->external ? '_blank' : null,
       );
     }
 
-    return $attributes + array('class' => $classes);
+    return $attributes;
   }
 
   protected function getTagContent() {