[Analyze 2718] Fix wizards shiny source validation

[jerome-ng]

Summary

ShinyLive runs the dashboard inside a child iframe. The Wizards host previously accepted messages only from the outer iframe, so it rejected the dashboard’s SHINYLIVE_READY event and sent authentication context to the wrong window.

This change:

• Accepts readiness messages from the outer iframe or its direct dashboard child.
• Sends AUTH_TOKEN to the exact trusted sender.
• Validates message origin and source on both the Wizards and Shiny sides.
• Rejects unrelated same-origin frames.

Related to #2718. Follow-up to #2897.

[Copilot]

Pull request overview

This PR fixes postMessage source validation for the Wizards-embedded ShinyLive dashboard so readiness/error events are accepted from the expected frame(s) and auth context is sent back to the correct trusted window.

Changes:

• Adds a resolver to accept SHINYLIVE_READY from either the outer ShinyLive iframe or its direct dashboard child iframe.
• Targets AUTH_TOKEN postMessage responses to the exact window that emitted SHINYLIVE_READY, while continuing to validate event.origin.
• Adds unit tests covering accepted/rejected message-source scenarios.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
plugins/ui/apps/wizards/src/utils/shinyDashboardContext.ts	Adds resolveShinyDashboardMessageSource to validate/resolve the trusted message sender window.
plugins/ui/apps/wizards/src/utils/tests/shinyDashboardContext.test.ts	Adds tests for allowed and rejected message sources (outer iframe, direct child, unrelated/deeper frames).
plugins/ui/apps/wizards/src/components/ShinyDashboardIframe.tsx	Uses the resolver to validate message sources and targets AUTH_TOKEN to the readiness sender window.