Limit the extra options of jemalloc profiler

[chenBright]

What problem does this PR solve?

Issue Number:

Problem Summary:

Limit the extra options of jemalloc profiler to one of inuse_space, inuse_objects, alloc_space, alloc_objects, show_bytes, drop_negative, total_delay, contentions or mean_delay.

What is changed and the side effects?

Changed:

Side effects:

• Performance effects:

• Breaking backward compatibility:

---

Check List:

• Please make sure your changes are compilable.
• When providing us with a new feature, it is best to add related tests.
• Please follow Contributor Covenant Code of Conduct.

[wwbmmm]

LGTM

[Copilot]

Pull Request Overview

This PR adds validation for the extra_options query parameter in the jemalloc profiler to prevent arbitrary command injection. It ensures only valid jemalloc profiler options are accepted and refactors string concatenation to use safer string formatting functions.

• Introduces a whitelist of valid extra options for jemalloc profiler
• Adds validation to only accept predefined extra options
• Refactors string concatenation to use butil::string_printf and butil::string_appendf

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}