Fix link/origin referrer and login redirect (#36279)

Fix #35998

1. Fix `<a rel>` :
    * "_blank" already means "noopener"
* "noreferrer" is already provided by page's `<meta name="referrer">`
2. Fix "redirect_to" mechisam
* Use "referer" header to determine the redirect link for a successful
login
3. Simplify code and merge duplicate logic

templates/mail/repo/release.tmpl

@@ -41,7 +41,7 @@
 			{{if .Release.Attachments}}
 				{{range .Release.Attachments}}
 					<li>
-						<a target="_blank" rel="noopener noreferrer" href="{{.DownloadURL}}">
+						<a target="_blank" href="{{.DownloadURL}}">
 							<strong>{{.Name}} ({{.Size | FileSize}})</strong>
 						</a>
 					</li>