Secure iframe messaging with trusted parent-origin validation

[renjie-run]

Summary

• Restrict iframe requests, responses, events, and window events to the trusted parent origin.
• Allow wildcard messaging only for the initial server, access-token, and app UUID bootstrap requests.
• Fetch and configure the parent origin before sending subsequent SDK traffic.
• Improve initialization error handling and validation for access-token and bootstrap API calls.
• Add coverage for origin validation, bootstrap behavior, malformed responses, cleanup, and SDK initialization.

Testing

• Expanded Jest unit tests for HTMLPageAPI, IframeAdapter, and SDK initialization behavior.