use regex for iframe installer origin whitelist

all packaged apps require certs, even non-privileged ones, yeah. but what I'm asking is what's the threat if we receive a `postMessage` from any origin? just because the install origin is from `marketplace.firefox.com`, that doesn't mean the app is now granted any special powers. or am I missing something?