Custom visuals: allow same-tab navigation & reduce confirm-navigation friction for trusted links

Description:

Custom visuals (e.g. Deneb) that trigger navigation via href currently have two limitations that create friction for legitimate, author-controlled use cases:

1. Links always open in a new browser tab, even when the destination is another page of the same report, or a bookmarked view of it. This breaks the flow of dashboards designed to feel like a single cohesive experience — for example, a status tile that should take the user to a filtered detail page, in place, rather than spawning a second browser tab with a full report reload.
2. Every navigation triggers a "Confirm Navigation" dialog, with no way for a report author to pre-approve trusted destinations, and no way for an organization to establish a scoped trust policy for links that stay within contexts the tenant already controls (e.g. the same report, the same workspace, or the same tenant ID).

Proposed solution(s):

• Option A — Report/page-scoped trust: Allow a custom visual's href to navigate in-place (same tab) when the destination URL's reportId and ctid match the currently open report — i.e., navigating to another page or bookmark of the same report the visual lives in. This is a much narrower, more defensible trust boundary than "same domain," since it only ever keeps the user within content the current report's author already controls.
• Option B — Admin-level allowlist: Let a Fabric/Power BI tenant admin configure an allowlist of destination patterns (e.g. specific workspace or report IDs) for which the navigation confirmation is skipped for all users in that tenant, similar to how URL allowlisting already exists for other trust boundaries in the admin portal.
• Option C — Persistent "always allow" at the report level: Even short of removing the dialog, let the report author pre-declare a destination as trusted (visible to viewers as "this report's author has marked this link as safe"), rather than requiring each individual viewer to independently discover and click "Always allow" themselves the first time.

Why this matters: Dashboards that use custom visuals for interactive navigation (status tiles linking to detail pages, KPI cards linking to filtered views) currently produce a jarring "new tab + confirmation dialog" experience that native Button visuals with Page Navigation actions don't have — but native buttons can't carry a bookmark GUID to an external Service URL the way a custom visual's href can, so authors are forced to choose between a clean in-app experience and the specific navigation behavior they need.