Recent versions of the Source SDK block URLs that don't start with http or https (or aren't about:blank).
Here's my take on the workaround. No external custom service required (so no third-party trust), but it does require a static page, which is still against the idea of this thread.
If you can't / don't want to host a static page with embedded URLs in hashes (which is how my workaround works), you could theoretically
preload a custom popup page into the InfoPanel stringtable with your JavaScript and send it over to the client, but based on my experience with stringtables, you'd need a delay for it to propagate before displaying it.
Attached my personal test plugin for it; check the
ShowMOTDPopupStandalone and related functions. Haven't booted up CS:GO in a while so I'm not completely sure they're still in working order.