Missed this during local testing, but it's clearly preventing the message event from being dispatched when testing using Moodle demo + ngrok public sites.

https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage

Fix is simple: just use the issuer provided in the platform's openid config as the second param to the postMessage() call.

To replicate the issue:

1. Create new site locally
2. Make the site available over ngrok https
3. Enable auth_lti and enrol_lti
4. Go to Admin settings > Enrolments > Publish as LTI tool > Tool registration
5. Generate a dynamic registration URL and copy it
6. Now, log in to the demo/qa site as an admin (any public Moodle site where admin access is available)
7. Go to Admin settings > Plugins > External tool > Manage tools
8. Enter the dynamic registration URL in the "Tool URL" field
9. Click "Add LTI Advantage"
   Expected: the registration process runs through and you find yourself back on the manage tools page with a new tool card.
   Actual: the registration process gets stuck on a blank screen and you need to cancel to get back to the tool list. The registration was created, but the process stalled because of the postMessage message failing to be dispatched. You'll also see a js console error to this effect.