fix: add postMessage origin validation to useUserSync

[FaizanKolega]

Add origin validation to postMessage in useUserSync to prevent data leakage to untrusted iframes and block malicious parent windows from injecting fake user data. Resolves CWE-345 (Insufficient Verification of Data Authenticity) and OWASP A08:2021 vulnerabilities.

Change Summary

Added origin validation to both sender and receiver in useUserSync.ts postMessage communication:

Sender side: Replaced wildcard * origin with specific origin validation - only sends user data to same-origin iframes or explicitly trusted domains (docs.google.com for Google Docs viewer)

Receiver side: Added event.origin validation before processing messages - rejects messages from untrusted origins with console warnings

Fixes security findings:

• Rule fix(security): V3 - add SSRF protection to attachment URL upload #19: wildcard-postmessage-configuration - postMessage sender now uses specific origins instead of wildcard *
• Rule fix(security): V4 - apply SSRF protection to axios.head() in uploadViaURL #20: insufficient-postmessage-origin-validation - postMessage receiver now validates event.origin before processing

Files modified:

• packages/nc-gui/composables/useUserSync.ts

Change type

• feat: (new feature for the user, not a new feature for build script)
• fix: (bug fix for the user, not a fix to a build script)
• docs: (changes to the documentation)
• style: (formatting, missing semi colons, etc; no production code change)
• refactor: (refactoring production code, eg. renaming a variable)
• test: (adding missing tests, refactoring tests; no production code change)
• chore: (updating grunt tasks etc; no production code change)

Test/ Verification

Manual testing:

cd packages/nc-gui
npm run dev

Verify same-origin iframes work:

1. Create/open a shared view (Grid, Kanban, Form)
2. Test embed functionality
3. Check browser console - no postMessage errors
4. Verify user data syncs correctly

Verify Google Docs viewer works:

1. Upload an Office file (PDF, DOCX, XLSX) to an attachment field
2. Click to preview the file
3. Verify preview opens correctly in Google Docs viewer
4. Check console - no errors

Verify security working:

1. Open browser DevTools → Console
2. Check for warnings about untrusted iframe origins (expected behavior)
3. Verify no user data leaks to untrusted domains

Additional information / screenshots (optional)

Security Context:

• Severity: Medium
• CWE: CWE-345 (Insufficient Verification of Data Authenticity)
• OWASP: A08:2021 - Software and Data Integrity Failures
• Impact Before Fix: Any iframe could receive user data (id, email, display_name); any parent window could inject fake user data
• Impact After Fix: Only same-origin and explicitly trusted iframes receive data; untrusted origins are rejected

Backward Compatibility: ✅ Fully compatible - no breaking changes to existing functionality

• Same-origin shared views/forms continue to work
• Google Docs viewer continues to work
• Only blocks previously insecure behavior (untrusted iframes)

Implementation Details:

• Adds getIframeTargetOrigin() helper to validate iframe sources
• Extracts trusted origins list to constant for maintainability
• Handles edge cases (about:blank, data:, blob: URLs)
• Follows existing NocoDB coding patterns

This change is a defence-in-depth security improvement that prevents potential data leakage while maintaining full backward compatibility.