It took a couple of hours to find out, why URLs have not been wrapped with <a href="...>
The key was this post: Links and strip_unsafe_html - #2 by ctgraham and realising that I copied my config.inc.php from OJS Version 2.4. The pattern in allowed_html = ... meanwhile changed. So it is advised to upgrade this line, too.
Now I just have to find out why my addition of target="_blank" to pkp-lib/classes/citation/ Citation.inc.php does not work, yet.
But I am making progress.