Remove cross-origin postMessage()ing

[domenic]

Closes #196.

Things to discuss before merging:

• I've currently located the checks inside the posted tasks.

  • I am unsure whether this is necessary; could the origin change between the task being posted and it being run? Wouldn't we only run the task if the document was active, and thus the origin would have stay the same?
  • However, checking in the posted task matches the current targetOrigin check done in HTML, so maybe there's a good reason?
  • Even if it is necessary, should we consider also doing the check before posting the task? That seems slightly more developer-friendly.

• I've removed the non-options overloads for postMessage(), i.e. #205. That is, I kept postMessage(data, { transfer }), but removed postMessage(data, transfer). We could keep both if we preferred, but I prefer the options versions myself.

[domenic]

You've convinced me that my draft decisions are correct, so yay, merging!