Fix autofix to use canonical order (noopener noreferrer)

Match ember-template-lint behavior: strip existing noopener/noreferrer
tokens and re-add in canonical order, instead of appending missing ones.

Author: johanrd

lib/rules/template-link-rel-noopener.js

@@ -42,16 +42,14 @@ module.exports = {
             messageId: 'missingRel',
             fix(fixer) {
               if (relAttr && relAttr.value?.type === 'GlimmerTextNode') {
-                // rel attribute exists with a text value — append missing values
-                const oldValue = relAttr.value.chars;
-                const parts = oldValue.trim().split(/\s+/).filter(Boolean);
-                if (!hasNoopener) {
-                  parts.push('noopener');
-                }
-                if (!hasNoreferrer) {
-                  parts.push('noreferrer');
-                }
-                const newValue = parts.join(' ');
+                // Strip existing noopener/noreferrer tokens, then re-add in canonical order
+                // (matches ember-template-lint behavior)
+                const oldValue = relAttr.value.chars.trim().replace(/\s+/g, ' ');
+                const filtered = oldValue
+                  .split(' ')
+                  .filter((t) => t !== 'noopener' && t !== 'noreferrer')
+                  .join(' ');
+                const newValue = `${filtered} noopener noreferrer`.trim();
                 return fixer.replaceTextRange(
                   [relAttr.value.range[0], relAttr.value.range[1]],
                   `"${newValue}"`

tests/lib/rules/template-link-rel-noopener.js

@@ -31,7 +31,7 @@ ruleTester.run('template-link-rel-noopener', rule, {
     // rel="noreferrer" only — missing noopener
     {
       code: '<template><a href="/" target="_blank" rel="noreferrer">Link</a></template>',
-      output: '<template><a href="/" target="_blank" rel="noreferrer noopener">Link</a></template>',
+      output: '<template><a href="/" target="_blank" rel="noopener noreferrer">Link</a></template>',
       errors: [{ messageId: 'missingRel' }],
     },
     // rel="nofollow" — present but wrong values