fix(auth): validate origin of oauth callback to prevent login csrf

[deepak0x]

This pull request fixes a critical security vulnerability in the OAuth login flow where the application accepted OAuth callback messages from any origin.

Previously, the postMessage event listener in loginWithRocketChatOAuth did not validate the origin of incoming messages. This allowed malicious websites to forge OAuth callbacks and potentially force users to log in with attacker-controlled accounts.

Closes #1071

Fix

• Added validation to ensure event.origin matches the trusted Rocket.Chat server origin
• The expected origin is derived from config.api.baseUrl
• Messages from untrusted origins are ignored

Only messages from the configured Rocket.Chat server are now accepted.