fix(data-browser): validate messages arriving in the webview VSCODE-804

[ivandevp]

Description

Hardens inbound message handling in the data browser webview:

• messages are only processed when they come from the panel's own webview origin
• payloads are validated against the command they declare before being dispatched, and unknown commands are ignored

On the approach: the check originally suggested on the ticket, event.source !== window.parent, is not viable here. The webview app runs in a sandboxed frame where window.parent is the frame itself, so that comparison discards legitimate messages. This was verified against a running extension host, where the origin comparison holds for everything VS Code delivers.

Checklist

• New tests and/or benchmarks are included
• Documentation is changed or added
• I have signed the MongoDB Contributor License Agreement (https://www.mongodb.com/legal/contributor-agreement)

Motivation and Context

• Bugfix
• New feature
• Dependency update
• Misc

Open Questions

Dependents

Targets the VSCODE-805 branch, since it builds on that work. Retarget to main once #15 merges.

Types of changes

• Backport Needed
• Patch (non-breaking change which fixes an issue)
• Minor (non-breaking change which adds functionality)
• Major (fix or feature that would cause existing functionality to change)