Generator-enforced `IPC::Untrusted<T>` for origin-bearing UIProcess messages

Component: WebKit IPC | 43379f4

WebKit splits work between a sandboxed WebContent process and a privileged UIProcess, with the messages between them declared in .messages.in files and turned into C++ by generate-message-receiver.py. Origin-bearing types like SecurityOriginData and ClientOrigin drive security-relevant decisions in the UIProcess — permissions, geolocation, WebAuthn, site isolation — but historically whatever origin the WebContent process claimed was taken at face value. Since a compromised renderer is an untrusted, attacker-controlled component in WebKit's threat model, every origin it reports needs checking against ground truth before the UIProcess acts on it.

Third in the IPC-hardening series, this commit adds the generator and build-system support (untrusted_origins.py, generator enforcement, header and type plumbing) that makes the message-receiver generator refuse to compile a UIProcess handler taking a bare SecurityOriginData, ClientOrigin, RegistrableDomain, Site or SecurityOrigin from a WebContent-originated message. The parameter must be wrapped in IPC::Untrusted<T>. All 37 existing call sites are wrapped.

Significance

Every one of the 37 wrapped call sites still calls unsafeExtractWithoutValidation(NeedsReview), so nothing is validated at runtime yet — the win is that every unvalidated origin path is now enumerable in the type system. Later commits in the series replace those call sites with designated validation procedures (IPC::IsValidationProcedureFor specializations) before the value can be used.

Audit directions

The forward-facing pattern is a compiler-enforced deny-list of types on one process boundary. Narrow: the 37 NeedsReview extractions are a published worklist of every UIProcess handler that currently trusts a renderer-claimed origin, and each one is worth reading now for what the handler does with the value — the ones that reach a permission or storage decision are the interesting half. Wider: the enforcement keys on five named types, so an origin that reaches the UIProcess inside a struct, inside a URL, or as a string field passes the generator untouched; sweep the .messages.in declarations for parameter types that transitively carry an origin without being one. Widest: the same trust question applies to every WebContent-to-privileged-process path, and this commit covers only the UIProcess direction — the Networking process receives origin-bearing messages from WebContent on paths the generator change does not gate. The review tell is a message-handler parameter whose type name ends in Data or Domain and is not wrapped.

---