Prevent non-ajax, non-trusted requests

Problem/Motivation

We experienced bots spamming our extlink URLs and added a test to verify that header x-requested-with was XMLHttpRequest.

Steps to reproduce

Find an external link on your site, copy the URL and paste in a new browser window. Ideally these should return forbidden if requested directly.

Proposed resolution

See attached patch which we have successfully used to mitigate this.

Remaining tasks

Please review.

User interface changes

API changes

Data model changes

Note, we have applied our patch against the D9 fork of this module (https://git.drupalcode.org/issue/extlink_extra-3137861.git) - but had to select 8.x-1.x-dev as version.