Add option to force verifiable-parent message transport to rpc.js

Some type=url gadgets may retrieve sensitive data via cookie, and potentially communicate that data to their container by way of gadgets.rpc.

In this case, such gadgets need to verify their parent to avoid this data being stolen by a malicious website.

The attached patch forces use of a "verifiable parent" message transport - currently, only IFPC fits this description, as a transport whose relayUrl can be trusted for its host information, when the message is sent correctly at all.