Fix missing noopener on external chat markdown links

[sabraman]

Summary

External links rendered by ChatMarkdown opened in a new tab with rel="noreferrer" but without noopener.

This path is used for links that are not resolved to local workspace files, so the web UI was missing the standard hardening that prevents the opened page from getting a handle back to the opener.

What changed

• add noopener alongside noreferrer for external markdown links rendered in ChatMarkdown
• add a focused regression test that asserts the rendered anchor includes the expected new-tab attributes

Verification

• bun x vitest run apps/web/src/components/ChatMarkdown.test.tsx
• bun fmt --check
• bun lint
• bun typecheck