fix: prevent HTML form elements from rendering in user chat input

[ifer47]

Summary

• User input in the Question component was rendered through the full Markdown pipeline, which allows raw HTML tags including <button>, <form>, <input>, etc.
• These tags are intentionally permitted in LLM responses for human-input form rendering, but user-supplied messages should never produce interactive HTML elements
• Entering <button class="primary-button">Confirm</button> in the chat input would render as an actual clickable button
• Pass customDisallowedElements to the Markdown component in the Question component to strip button, form, input, textarea, label, select, and option elements from user messages

Closes #37414

Test plan

• Verified that <button>Confirm</button> in user input is stripped instead of rendered as an interactive element
• Verified that LLM responses with human-input forms still render correctly (no changes to answer rendering)
• Existing Question component tests continue to pass

🤖 Generated with Claude Code Best