Use custom event rather than window.postMessage
window.postMessage requires a targetOrigin which isn't enforced by all browsers.
This patch changes it to send a custom event which reduces the likelihood of interference and eavesdropping.
BUG: 411423
Differential Revision: https://phabricator.kde.org/D23568