[nix-2.28] backport CVE-2025-54800 / GHSA-7qwg-q53v-vh99 (queue-runner validation + template escapes)

[dkgkdfg65]

backport of the GHSA-7qwg-q53v-vh99 / CVE-2025-54800 fix series to the nix-2.28 branch. covers the hydra-queue-runner validation side (the substantive fix) plus the template-side HTML.attributes refactor and the existing escape-inputs touch-ups.

commit list (11 of the 12 in the upstream merge dea1e168f5):

• hydra-queue-runner: Fix crash when < > are in hydra-build-products
• hydra-queue-runner: Fix potential UB
• hydra-queue-runner: Verify product names in hydra-build-products
• hydra-queue-runner: Validate release name
• hydra-queue-runner: Validate metric name in hydra-metrics
• hydra-queue-runner: Validate hydra-metrics unit
• hydra-queue-runner: Validate metric type
• product-list: Escape untrusted values
• build: Properly escape all input values
• templates: Use HTML.attributes for all links
• templates: Make whitespace in [% %] consistent

omitted from upstream (1 of 12): c6424f37 templates: Hopefully escape all template inputs — it conflicts structurally on nix-2.28's machine-status.tt (introduces primarySystemType + a popover that depends on a data-model field not present here). the queue-runner validation already rejects the dangerous inputs at the source, so the template-side wrap is defense-in-depth; happy to do a separate PR for it after the data-model bits land.

two small manual resolutions during the cherry-pick:

• src/root/jobset-eval.tt: preserved the existing [% ELSE %] ... couldn't find ... block that was added on nix-2.28 after the patch's base, and applied the HTML.attributes(href => ...) wrapping around the link inside it.
• src/root/log.tt: kept the existing the build log of derivation <tt>...</tt> line (nix-2.28 doesn't carry the extra (<a ...>raw</a>) link that the patch adds; the fix's purpose is escaping existing constructs, and nix-2.28 doesn't have that construct yet, so wrapping was a no-op).

verified the queue-runner-side validation A/B as a standalone harness on top of ubuntu:22.04 + g++: the build-result.cc regex whitelists do reject <script>..., <img onerror=..., <svg onload=... style payloads in releaseName / product.name / metric.name / metric.unit fields pre-vs-post, matching the upstream behaviour.

refs:

• GHSA-7qwg-q53v-vh99
• CVE-2025-54800
• upstream merge: dea1e168f5

happy to rebase / split / drop commits if you'd rather take a narrower subset.