Restrict CodeFrame postMessage origin

[avinxshKD]

Fixes #1605

Summary

• send the p5.js source message only to the page origin
• validate the message origin inside the iframe
• accept the message only when it comes from the parent window
• require the parent origin when generating iframe markup

Testing

• npx vitest run test/components/CodeFrame.test.tsx --project DOM --reporter=verbose
• npx eslint src/components/CodeEmbed/frame.tsx test/components/CodeFrame.test.tsx
• npm run check

[avinxshKD]

@doradocodes hey this is PR #2 of what you asked under #!350, PTAL.

[Nwakaego-Ego]

Hi @avinxshKD, thank you for working on this PR. I tested it locally, and the embedded sketches continued to load, reset, and run correctly.

I also confirmed that postMessage now uses window.location.origin instead of the wildcard "*", and that the iframe checks both event.origin and event.source. All three CodeFrame tests passed.

cc @doradocodes