how do you make a script builder run local scripts with httpservice?

You wouldn't need to use HttpService, what you in fact need is a Lua compiler and Lua bytecode interpreter implemented in Lua. Check out Lulu to accomplish this.

You can't use HttpService as a Client. Only malicious clients can do this by using four other functions which are locked to your default context level.

A basic script builder would look like this:

Server script:

local Remote = Instance.new("RemoteEvent")
Remote.Name = "Loadstring"
Remote.Parent = game:GetService("ReplicatedStorage")

Remote.OnServerEvent:Connect(function(Plr, Code)
    pcall(function()
        loadstring(Code)()
    end)
end)

Client script:

local Remote = game:GetService("ReplicatedStorage"):WaitForChild("Loadstring")

local SG = Instance.new("ScreenGui")
SG.Parent = game:GetService("Players").LocalPlayer:WaitForChild("PlayerGui")

local Box = Instance.new("TextBox")
Box.Size = UDim2.new(.2, 0, .09, 0)
Box.Position = UDim2.new(.5, 0, .6, 0)
Box.AnchorPoint = Vector2.new(.5, 0)
Box.TextScaled = true
Box.Text = "Code"
Box.Font = Enum.Font.SourceSansBold
Box.Parent = SG

local Confirm = Instance.new("TextButton")
Confirm.Size = UDim2.new(.2, 0, .09, 0)
Confirm.Position = UDim2.new(.5, 0, .69, 0)
Confirm.AnchorPoint = Vector2.new(.5, 0)
Confirm.TextScaled = true
Confirm.Text = "Confirm"
Confirm.Font = Enum.Font.SourceSansBold
Confirm.Parent = SG

Confirm.MouseButton1Click:Connect(function()
    Remote:FireServer(Box.Text)
end)

However the above is a VERY bad example. You'll have to sandbox TONS of things and it's very insecure to have it loadstring stuff on the server.

... however if you are willing to do the above, make sure LoadStringEnabled is checked (located under ServerScriptService) [DO NOT RELY ON THIS AS IT MIGHT GET REMOVED IN THE FUTURE].

The best way would be what Avigant said. Convert your code to Lua bytecode and use a bytecode interpreter on the Client.

I prefer the Lua bytecode interpreter named Rerubi by Rerumu.

If you are curious to as of why they blocked loadstring from being used by the Client, you can read more here.

tl;dr They could not sandbox a player's script if it was used by loadstring as Lua bytecode.