Use Programmatic Anchor Clicks for Same-Origin URLs

From Winter '27, calling window.open(url, '_blank') (or omitting the target, which defaults to _blank) for a same-origin Salesforce URL throws a LockerSecurityError under Lightning Web Security for Aura, so code that opens same-origin links or downloads in a new tab breaks. Replace those calls with a programmatically created, detached anchor element that sets href, target='_blank', and rel='noopener noreferrer', then calls click() without appending to the DOM. For same-tab navigation use window.open(url, '_top') or set a.target to '_top'/'_self'/'_parent'.