WearablePreview controller accepts postMessage from any origin (no origin/source validation)

## Summary
`src/components/WearablePreview/WearablePreview.controller.ts:99` registers `window.addEventListener('message', handleControllerMessage, false)` and `handleControllerMessage` processes `CONTROLLER_RESPONSE`/`EMOTE_EVENT`/`LOAD` messages with **no `event.origin` or `event.source` validation**. Any frame/window on the page can resolve/reject the controller's pending promises with attacker-controlled payloads.

## Impact
Consuming apps that embed WearablePreview receive forged controller responses/events from an untrusted source. (Same class as the legacy `ui` controller and the `auth` AvatarSetupPage handler.)

## Fix
Validate `event.origin` against the iframe's `src` origin and/or `event.source === iframe.contentWindow` before processing.