Fix postMessage origin bypass and playsound DOM XSS (master source)

[wpexpertsio]

Summary

• Apply the same security fixes from Fix postMessage origin bypass and playsound DOM XSS #3797 to the master source file js/elFinder.js
• Replace prefix indexOf(origin) with exact URL.origin matching
• Prevent playsound DOM XSS via filename allowlist + DOM APIs
• Sanitize untrusted bind from postMessage payloads

Follow-up to #3797 as requested: the previous change landed on 2.1-src (generated build), so this PR targets master source.

Test plan

• Same-origin / connector-origin postMessage still works
• Prefix attacker origin is rejected
• Malicious soundFile does not inject HTML / XSS
• Normal rm.wav still plays when sound is enabled

Credit

WPExperts / Advanced File Manager

[nao-pon]

@wpexpertsio Thanks for creating a new PR against master, and sorry for the extra work!