… message

Previously, the `INITIALIZE` action in `onMessage` was handled before the
`isClient()` guard, allowing any source — including cross-origin iframes or
unknown `MessagePort` handles — to trigger SW initialization without
verification.

The fix explicitly checks that the message source is either the SW's own
registration or a legitimate client before proceeding with `ensureInitialized`.

**Example of the previous behavior:**

A cross-origin iframe with a `postMessage` handle to the SW could trigger
initialization at an arbitrary time:

```js
// attacker-controlled iframe on https://evil.com
navigator.serviceWorker.getRegistration('/').then(reg => {
  reg.active.postMessage({ action: 'INITIALIZE' });
});
```

This would bypass the `isClient()` check that guards all other actions and
invoke `ensureInitialized()` from an untrusted source, racing with cache
writes during first-load initialization.

**After the fix**, messages with `action: 'INITIALIZE'` are accepted only
from the SW's own registration (`self.registration.active/installing/waiting`)
or from a verified client. All other sources are silently dropped, consistent
with how all other actions are handled.