[security] Verify message source in Firefox add-on

The source of the `message` event was not checked, leading to potential security issues.
To fix this, I've added a check to the message event: The message is rejected if `event.source` is not `null` (ie. when the message does not originate from Chrome code ([ref](https://developer.mozilla.org/en-US/docs/Web/API/Window.postMessage#Using_window.postMessage_in_extensions__)).