There is a rather simple solution in two steps:
No, HTTPS doesn't stop this threat.
Please understand that while solutions do exist, they won't be entirely trivial to deploy. You've stumbled upon a hard problem in web security; the web just wasn't designed to support this kind of thing, and as a result, the solutions necessarily end up being a pretty complex piece of technology. So you will probably need support from a capable developer to deploy and integrate one of these solutions into your web site.
Shameless, but relevant plug:
Caja allows websites to safely embed DHTML web applications from third parties, and enables rich interaction between the embedding page and the embedded applications. It uses an object-capability security model to allow for a wide range of flexible security policies, so that the containing page can effectively control the embedded applications' use of user data and to allow gadgets to prevent interference between gadgets' UI elements.
If you allow google tracking, you already allow XSS, because google-analitics is by definition an XSS.
You could set up a template where the user would only paste his ID that you could sanitize properly.
1) Add Identity
2) Add a use policy: https://www.google.com/analytics/tag-manager/use-policy/
3) I am against server site filtering whitelisting/blacklisting because it is workaround to the main problem, it is difficult to do right and can drop input that should not be dropped. When you have HTML5, CSS3 and JS ever evolving you will need to keep on updating your whitelist/blacklist until the point that sanitizer in place just becomes enourmous peace of code that does allow everything and therefore it will come to a point that defeats its purpose, but if you insist on this track OWASP HTML Sanitizer,JSoup is another example apart from above mentioned.
4) Instead of 3) use https://content-security-policy.com/ and drop support for ancient browsers, which is the proper way of fixing this as on the server you would just store content but execute in browser context
6) Run AV and fortify static code analyzer on server and move it on
7) Built in validation for errors: JSLint/JSHint/CSSHint,etc
8) Finally if you dont trust any of above automation add the human factor to review and approve the step before publishing