docs: incoming message origin validation across platforms

[michaeljsXu]

What changes are you making?

Document incoming message origin validation for Web, Android, Swift, and React Native.

Add cross-platform sample controls and a shared checkout smoke scenario that enables a restrictive allowlist before presentation. Add real-browser Web coverage for a popup that navigates between HTTPS origins, with Chromium and WebKit execution in CI.

How to test

cd platforms/web && pnpm test:e2e
cd platforms/react-native && pnpm test sample/src/e2e --runInBand
cd platforms/android/samples/CheckoutKitAndroidDemo && ./gradlew :app:testDebugUnitTest --tests 'com.shopify.checkout_kit_android_demo.e2e.*'
cd platforms/swift && ./Scripts/lint

[michaeljsXu]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• docs: incoming message origin validation across platforms #478 👈 (View in Graphite)
• feat: incoming message origin validation for react native #477
• feat: incoming message origin validation for ios #476
• feat: incoming message origin validation for android #475
• feat: incoming mesage origin validation for web #474
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[tiagocandido]

Closing — everything here either landed already or documents the removed callback. The Swift/Android README sections (including the origin format details) went in with #646/#647, the RN section ships with #648, and the web README on main already covers allowed-origins. The remaining onMessageRejected docs will go away with the web callback removal before GA.