build custom metric dropdowns with DOM APIs

[1seal]

summary

this replaces HTML string concatenation in startCustomMetrics() with jQuery DOM construction for custom metric dropdowns.

why

custom metric names were previously interpolated into markup before being passed to $(), which let the browser parse attacker-controlled content as HTML instead of treating it as data.

what changed

• build the dropdown wrapper, button, caret, label container, and metric container with jQuery element constructors
• keep the custom metric name in attribute values created through DOM APIs rather than through parsed HTML strings

validation

• node --check cmd/internal/pages/assets/js/containers.js
• local red/green verification with the attached reproduction artifacts:
  • make canonical
  • make fixed

[github-actions]

This PR is stale because it has been open 90 days with no activity. This PR will be closed in 30 days unless new comments are made or the stale label is removed. To skip these checks, apply the "lifecycle/frozen" label.