Sorry for the delay in responding, this one slipped through the cracks.
I reached out to the vendor, and here is their response.
Those attributes are added by Discourse when it processes the raw content of posts. The purpose of rel=“nofollow noopener” is to prevent tabnabbing when links are set to open in a new tab. Discourse parses the post’s raw text. If it finds a link with the
target="_blank" attribute, it adds the
noopener .emphasized text
Regarding the CAPTCHA at login, this is part of the company SSO, and is not controlled at the forum level. Note, that I have shared your feedback with the team for consideration in future updates.