fix(electron): bind websocket on 8084 to loopback only (CWE-306)

The WebSocket server on port 8084 was created without a host option, so ws
bound to 0.0.0.0. Any device on the same LAN could connect, register itself as
the trusted flowchart socket (type 0 / id 2), then send type 7 and receive every
cookie of the automated browser session.

Bind to 127.0.0.1 so the port is no longer reachable from the network.

An Origin allowlist is deliberately not added: the extension content script
(Extension/manifest_v3/src/content-scripts/messageInteraction.js) connects from
every scraped page, so its Origin is the page's origin and cannot be
distinguished from a malicious page. Token auth for the type 7 path is left for
a follow-up PR.

Refs: #986

ElectronJS/main.js

@@ -1411,7 +1411,9 @@ function send_message_to_browser(message) {
 const WebSocket = require("ws");
 const {all} = require("express/lib/application");
 const {copy} = require("selenium-webdriver/io");
-let wss = new WebSocket.Server({port: websocket_port});
+// 8084 端口只服务本机页面与浏览器扩展，绑定到回环地址，避免同网段设备直连。
+// 见 issue #986：未限制监听地址时，任意局域网设备都能连上并窃取浏览器 Cookie。
+let wss = new WebSocket.Server({host: "127.0.0.1", port: websocket_port});
 wss.on("connection", function (ws) {
     ws.on("message", async function (message, isBinary) {
         let msg = JSON.parse(message.toString());