Check who sends postMessage to the editor modal and bridge

[erseco]

Stacked on #137.

Security fix: check who sends postMessage

• assets/js/exelearning-editor.js: the editor modal accepted a relayed {source:'wp-exe-editor', type:'request-save'} from any window or origin. It now accepts it only from its own window and origin (the standalone editor page relays Ctrl+S that way).
• assets/js/wp-exe-bridge.js: the bridge inside the editor iframe accepted WP_REQUEST_SAVE, WP_REQUEST_EXPORT, GET_PROJECT_INFO and CONFIGURE from any sender. It now accepts them only from window.parent, and from the declared parent origin when one is configured.

Replies already went only to the parent origin, so nothing leaked. The impact was forced saves or exports driven by a foreign window.

Out of scope: previews stay same-origin

An earlier version of this PR also dropped allow-same-origin from the wp-admin package previews. That was reverted. Packages need storage and cookies (teacher mode, scored iDevices), embedded video needs the parent relay, and Playground cannot serve opaque-origin subframes. The opaque-origin viewer lands as a whole in #56.

Verification

npm run test:js: 245 passed, including new tests showing that the bridge and the modal ignore foreign senders or origins.

[github-actions]

Test in WordPress Playground

Test the plugin with the code from this branch:

ℹ️ The eXeLearning editor is fetched from the shared release and unpacked into the plugin when the playground boots, so the first load may take a few extra seconds. ELP upload, shortcode, Gutenberg block and preview work normally.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 96.87%. Comparing base (f44aa80) to head (fa38125).

Additional details and impacted files

@@                           Coverage Diff                            @@
##             hotfix/style-package-nested-allowlist     #138   +/-   ##
========================================================================
  Coverage                                    96.87%   96.87%           
  Complexity                                     864      864           
========================================================================
  Files                                           39       39           
  Lines                                         4322     4324    +2     
========================================================================
+ Hits                                          4187     4189    +2     
  Misses                                         135      135           

Flag	Coverage Δ
javascript	95.71% <100.00%> (+<0.01%)	⬆️
php	97.25% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
assets/js/exelearning-editor.js	88.18% <100.00%> (ø)
assets/js/wp-exe-bridge.js	98.78% <100.00%> (+0.01%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.