Sanitize URL substring used for determining if the instance is hosted (#14526)

- Sanitizes URL substring used for determining if the instance is hosted
- Simplifies `isHosted()` method by using regex
- Fixes the [CodeQL warning](https://github.com/metabase/metabase/pull/14511/checks?check_run_id=1770709190) from #14511

* Guard against trailing forward slash `/`

frontend/src/metabase/lib/settings.js

@@ -88,12 +88,8 @@ class Settings {
   // Right now, all Metabase Cloud hosted instances run on *.metabaseapp.com
   // We plan on changing this to look at an envvar in the future instead.
   isHosted() {
-    return (
-      this.get("site-url") &&
-      this.get("site-url")
-        .toLowerCase()
-        .includes("metabaseapp.com")
-    );
+    // matches <custom>.metabaseapp.com and <custom>.metabaseapp.com/
+    return /.+\.metabaseapp.com\/?$/i.test(this.get("site-url"));
   }
 
   isTrackingEnabled() {