We fixed the main issue of this form in CVE-2020-9444, but the audit done at that time only included links found in rendered_markdown; this change completes our audit for links with target=_blank anywhere in the codebase.
The modal is rendered dynamically to avoid password managers inserting passwords into the input field too aggressively. Fixes #12523.