This lets apps communicate with each other, via Puter.
We probably want to limit this in some way, but for now, all apps are
allowed to send messages to any other apps.
The message is:
- `targetAppInstanceID`: The instance ID to send the message to
- `targetAppOrigin`: targetOrigin passed to postMessage(), in case we
want to restrict which URL can receive the message
- `contents`: The message to send to the target
The resizing and repositioning is safe from abuse in that the window's position and size cannot cause it to escape the viewport. More could be done here, e.g. rate limit resize/repos. I will request rate-limiting in a separate issue.
