Data URLs are not allowed to open top-level browsing contexts

[mattgarrish]

Data URLs are forbidden from

• manifest items
• href attributes in svg and html (except when the document is loaded inside an iframe)

It's also technically forbidden from script window.open and document.open calls, but not sure we can enforce.