Because recordings are resources that are external to Moodle, same as before, they should be displayed in a new tab when accessing them.

The problem right now is that as the clicks on the recording are triggering a BIGBLUEBUTTON_EVENT_RECORDING_VIEWED event, there is a redirect from the server.
As the click uses a generic ajax request applied to all the links/buttons used for recordings, the redirect is considered as XSS.