Add rel="noreferrer" to external links.

Tells browsers not to send the Referer header when following external
links. Among other things, this bypasses Pixiv's anti-hotlinking
protection when opening direct image sources from Pixiv.

app/helpers/posts_helper.rb

@@ -61,7 +61,7 @@ module PostsHelper
   def post_source_tag(post)
     # Only allow http:// and https:// links. Disallow javascript: links.
     if post.source =~ %r!\Ahttps?://!i
-      external_link_to(post.normalized_source, strip: :subdomain, truncate: 20) + " ".html_safe + link_to("»", post.source, rel: :nofollow)
+      external_link_to(post.normalized_source, strip: :subdomain, truncate: 20) + " ".html_safe + link_to("»", post.source, rel: "noreferrer nofollow")
     else
       truncate(post.source, length: 100)
     end