feat: add axe.frameMessenger with configurable allowedOrigins

[WilcoFiers]

Add a mechanism for axe integrations to change how axe-core communicates with frames. This allows us to avoid messages from interfering with page scripts that use window.sendMessage(). This better isolates axe-core from the page, by preventing axe from receiving messages from other scripts, and preventing those scripts from receiving messages from axe.

Recommendation: All axe-core integrations that can communicate through other means should use axe.frameMessenger to avoid issues with window.sendMessage(). See doc/frame-messenger.md for details.

Important: By default axe.frameMessenger, which uses window.sendMessage(), only communicates with frames that have the same origin. For cross-origin frame testing, configure the allowed origins through axe.configure({ allowedOrigins }). Frames that are not tested because they do not have a trusted origin are reported as incomplete in the frame-tested rule. See doc/API.md for details.