Make "Hide badge" option easily themable

Problem/Motivation

When the "Hide badge" option is enabled, an alternate branding message gets attached to forms, per Google's docs on hiding the recaptcha badge.

This site is protected by reCAPTCHA and the Google
    <a href="https://policies.google.com/privacy">Privacy Policy</a> and
    <a href="https://policies.google.com/terms">Terms of Service</a> apply.

The implementation in the Drupal module improves upon this, subtly, by adding target="_blank" to the URLs, which makes sense on a form. Even though most modern browsers will retain form data when you hit the back button, it makes sense to do what you can to avoid people from losing their form data.

However, the implementation in the Drupal module is flawed in a few additional ways:

1. Many sites will want to adjust font size or type treatment on the disclaimer text, however the current implementation in the Drupal module makes it harder to properly theme. The form element is the generic html_tag and the entire html is included inside a t() which means you need a hook_form_alter, hook_captcha_alter or, worse, a language override 🙀 to theme it.
2. According to the example screenshot in Google's docs, the branding message should be placed before the form action buttons.
3. There is no practical reason any website would need to intentionally let robots follow the Privacy and Terms links back to Google's website, and no reason to have real users send along referrer information when they click those links.

Proposed resolution

1. Re-implement the form element as a custom #theme wrapper and move the render array of doom, including the wrapper div, classes/attributes, and content into a Twig template to facilitate theming overrides.
2. Implement Google's preferred placement before the form action button(s) by adding a new toggle option in the UI or link to documentation on how to move the disclaimer text before the form submit buttons. Implementing this is fairly straightforward setting the hide_badge form element to one less than the Form Actions' #weight.
3. Add rel="noopener noreferrer nofollow" to the links by default.

Remaining tasks

User interface changes

API changes

Data model changes