Add TinaCMS postMessage fix references

[cookesan]

Adds the upstream merge commit and fixed package release references for GHSA-g5qx-h5f3-mp2f.

Evidence checked:

• Harden message origin checks and rich-text URL sanitization tinacms/tinacms#7056 merged as c491fc55e612725f5d775eeb1fdf3f8ba82314fa.
• The tinacms@3.9.3 and @tinacms/app@2.5.6 releases both include that merge commit and list the security hardening PR.
• npm package archives for tinacms 3.9.2/3.9.3 and @tinacms/app 2.5.5/2.5.6 match registry shasums; the fixed archives include origin/source checks for the admin and preview postMessage flows, plus exact target origins for preview messages.