Only allow DartPad injection from window.parent

[NDevTK]

w = open('https://docs.flutter.dev/cookbook/effects/staggered-menu-animation#interactive-example');
setTimeout(() => {
 w[0].postMessage({sourceCode: ':)', type: 'sourceCode'}, '*')
}, 1000)

This PR forces code injection to be from the parent so I cant modify docs.flutter.dev :)
Improvement on #2943 but still don't know what I'm doing.