Preload the Vomnibar and control it using a message port

This fixes #1361 by preloading the Vomnibar iframe and stopping our use of frame location to control it.

Now, the Vomnibar is controlled via a port created with `MessageChannel`. Passing this port with the iframe without allowing a malicious page/extension to do the same required some extra work (involving a shared secret), which can be seen in commit d98abae007f7d32195357c022ec99171e36f2b19.