null link on plugins and noopener / noreferrer

Resolves a (non) security issue brought up by LGTM but I think the noopener and norefferer are good shouts

src/static/js/admin/plugins.js

@@ -84,9 +84,10 @@ $(document).ready(() => {
 
       for (const attr in plugin) {
         if (attr === 'name') { // Hack to rewrite URLS into name
-          const link = $('<a>');
+          const link = $('<a href="">'); // intentional null href
           link.attr('href', `https://npmjs.org/package/${plugin.name}`);
           link.attr('plugin', 'Plugin details');
+          link.attr('rel', 'noopener noreferrer');
           link.attr('target', '_blank');
           link.text(plugin.name.substr(3));
           row.find('.name').append(link);