profiling.sampling flamegraph does not escape function names in HTML output

Bug description

The flamegraph exporter in profiling.sampling embeds profile strings into the generated HTML without escaping:

1. _create_flamegraph_html writes json.dumps(data) into an inline <script> block. A function name containing </script> breaks out of the script element.

2. flamegraph.js interpolates the raw function name into a tooltip via .html() (innerHTML).

The sibling heatmap exporter already escapes its embedded data (html.escape(json.dumps(...))), and flamegraph.js already defines and uses escapeHtml() for displayName and source lines -- the function name was missed.

As a bonus, <lambda>, <module>, <genexpr> currently render as empty tooltip titles because the browser drops them as unknown tags. Escaping fixes this.

CPython versions tested on

main

Operating systems tested on

macOS

Linked PRs

• gh-153841

Start at _create_flamegraph_html in profiling.sampling and inspect how json.dumps(data) is embedded in the inline script, then review the function-name tooltip path in flamegraph.js. Compare the existing heatmap escaping and escapeHtml() uses. Done means function names cannot break the script or be interpreted as HTML, and names such as render correctly.