fix: validate event.origin in handleConnect to prevent channel hijacking

[kapeka0]

handleConnect accepts any incoming bidc-connect message as long as the
channelId matches — it never checks where the message came from. Since the
default channelId is "bidc_default" and any window with a handle to the
target (opener, parent, named frame) can postMessage to it, a malicious
window that knows or guesses the channelId can complete the handshake and
hijack a legitimate channel, intercepting all subsequent communication.

A possible fix is to add an optional origin argument to createChannel. When provided:

• Inbound: connections whose event.origin differs from the declared
  origin are rejected in handleConnect.
• Outbound: the origin is used as the targetOrigin for postMessage
  instead of '*', so handshake messages aren't broadcast to other origins.

The expected origin has to be declared by the caller — it can't be derived
from a cross-origin target (contentWindow.origin throws a SecurityError),
and deriving it from the first handshake (trust-on-first-use) is a race an
attacker can win, so it wouldn't actually be safe.

createChannel(target)                        // unchanged, no validation
createChannel(target, channelId)             // unchanged
createChannel(target, channelId, origin)     // NEW: validate against origin
createChannel(channelId, origin)             // NEW: iframe side (no target)

Fully backward compatible: without origin, behaviour is identical to before.