fix(wallet): require secure-site origin on W3mFrame postMessage

[SashaMIT]

Summary

• Host-side W3mFrame frame-event handlers accepted any @w3m-frame/* message with no event.origin check.
• Sibling social/connector helpers already require SECURE_SITE_ORIGIN.
• Require SECURE_SITE_SDK_ORIGIN on registerFrameEventHandler / onFrameEvent, and target postAppEvent to that origin instead of *.

Test plan

• Manual: email/social login via AppKit still completes
• Manual: forged postMessage from a same-page iframe with @w3m-frame/GET_USER_SUCCESS is ignored

Made with Cursor

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4ce8058

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

@SashaMIT is attempting to deploy a commit to the Reown Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

Thank you for your contribution! We ask that you please read and sign our CTA Document before we can accept your contribution. You can sign the CTA simply by posting a Pull Request Comment with the following text:

---

I have read the CTA Document and I hereby sign the CTA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}