[JENKINS-74745] Make ?link attribute work when CSP is enforced

[daniel-beck]

JENKINS-74745

This removes the inline JS in favor of an a link. This link works even when Jenkins 2.539+ enforces Content Security Policy, prohibiting inline scripts.

#457 discusses problems with the feature as it currently exists, so it's not clear to me what the supported use cases are. If the use case is indeed showing the image in an iframe, this PR will not help, unless administrators use https://plugins.jenkins.io/csp/ to relax the frame-ancestors directive (which is still better than having to allow script-src 'unsafe-inline' though).

Testing done

Accessed the image URL directly. With valid ?link value, click opens new tab. Without, no link. With and without CSP enforcement.

In an iframe, without CSP enforcing frame-ancestors, it also works.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

[MarkEWaite]

Thanks!