fix: Card URL validation

[XOP]

Description

Harden how CardHorizontal and CardPrimary open infoUrl.

• Open infoUrl with noopener, so the new page can no longer reach back into the app through window.opener (reverse tabnabbing). Browsers add this for <a target="_blank"> but not for window.open.
• Open only http(s) URLs
• Added util and test

Links and tickets

• Supersedes fix(CardHorizontal): 🐛 Security URL validation #1000. That version rejected relative infoUrl values silently and covered CardHorizontal only.
• MDN: Window.open() security considerations

Checklist

• Breaking changes? (add migration notes in changesets)
• Visual changes? (specify in changesets)
• Design review needed?

Contribution

• Sufficient research before PR
• Self-reviewed the PR
• build and build-storybook work locally
• Tests and Stories are aligned with the changes

Accessibility

Skipped: no markup, focus, keyboard or style change. Only what happens after a click changed.

Screenshots

No visual change.

[changeset-bot]

🦋 Changeset detected

Latest commit: e8bb109

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@clickhouse/click-ui	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[workflow-authentication-public]

Storybook Preview Deployed

✅ Preview URL: https://click-lowvjhiyk-clickhouse.vercel.app

Built from commit: 6ad7fe79c373a26d89c2a534cf4064df41512b54