fix metric vec label input aliasing

[Saithej2k]

Summary

• clone caller-provided Labels maps when MetricVec has no label constraints
• clone caller-provided label-value slices in the no-constraint GetMetricWithLabelValues path
• add regression tests that mutate caller-owned inputs between hashing and metric creation

Why

When no label constraints are configured, constrainLabels and constrainLabelValues returned the caller-owned map or slice directly. MetricVec hashes those values first and can then read the same caller-owned input again while creating or matching a metric. If the caller mutates that input concurrently, the internal reads can race and can associate the hash with mutated label values.

Fixes #1951.

Validation

• go test -race ./prometheus -run 'TestMetricVecGetMetricWith.*Copies' -count=1
• go test -race ./prometheus -run 'TestMetricVec' -count=1

I also tried go test -race ./prometheus -count=1, but my local Go runtime metrics differed from the checked-in Go collector fixtures, causing unrelated go_collector_latest_test.go failures.

[bwplotka]

Thanks but we prefer performance vs making it ultra safe for all cases. However some commentary would be useful. See #1951 (comment)