build custom metric dropdowns with DOM APIs

[1seal]

summary

this replaces HTML string concatenation in startCustomMetrics() with jQuery DOM construction for custom metric dropdowns.

why

custom metric names were previously interpolated into markup before being passed to $(), which let the browser parse attacker-controlled content as HTML instead of treating it as data.

what changed

• build the dropdown wrapper, button, caret, label container, and metric container with jQuery element constructors
• keep the custom metric name in attribute values created through DOM APIs rather than through parsed HTML strings

validation

• node --check cmd/internal/pages/assets/js/containers.js
• local red/green verification with the attached reproduction artifacts:
  • make canonical
  • make fixed