fix(trace-viewer): support token-gated Blob embedding

[baev]

Summary

• Restores a supported way for embedded reports to pass an already-available trace Blob into Trace Viewer.
• Cross-origin postMessage trace loading now requires an explicit postMessageToken, while same-origin loading continues to work as before.
• Documents the embedding flow for report integrations.

Reports can now embed Trace Viewer like this:

<iframe src="https://trace.playwright.dev/?postMessageToken=<token>"></iframe>

and send:

viewer.contentWindow.postMessage({
  method: 'load',
  params: { trace: traceBlob, postMessageToken: '<token>' },
}, 'https://trace.playwright.dev');

Fixes #40960