fix: a page whose origin has no host is never told an address by accountsChanged (closes #564)

The background judges each tab by its URL's origin, the only one it can see, so a page its server sandboxes, whose own origin is null, was still sent the new active address on an address switch although all its requests are refused.

The background now names the origin it judged by on each accountsChanged event, and the content script passes the address to the page only when the page's own window.origin is that origin, an empty list otherwise. An event naming no origin also reaches the page as an empty list. chainChanged is unchanged. The README's SiteApproval section says the same.

Judgement call: covered by a unit test that sets window.origin; no browser-suite test.

Model: opus-5-5

README.md

@@ -2175,14 +2175,17 @@ view would leave a wallet one click from deletion.
   code `4100` and opens no prompt. Two such origins are `null`, which the
   browser reports for a page with an opaque origin, such as one its server
   sandboxes with a Content-Security-Policy, and `file://`, which Chrome reports
-  for a local file. The background script prefers the toolbar popup
-  (`action.openPopup()`) and falls back to a separate popup window
-  (`src/background/index.js`, `requestApproval()`). Only one exists per site at
-  a time: a further connection request from a site whose prompt is still
-  unanswered is refused with EIP-1193 code `-32002` and opens no new prompt. If
-  that prompt was in a toolbar popup that closed before it connected, and the
-  toolbar popup has since been set to open something else, the refused request
-  shows that prompt again.
+  for a local file. Nor is such a page told the active address by
+  `accountsChanged`, even at a connected site's URL: the background names the
+  origin of the tab's URL on the event, and the content script passes the
+  address on only to a page whose own origin is that one. The background script
+  prefers the toolbar popup (`action.openPopup()`) and falls back to a separate
+  popup window (`src/background/index.js`, `requestApproval()`). Only one exists
+  per site at a time: a further connection request from a site whose prompt is
+  still unanswered is refused with EIP-1193 code `-32002` and opens no new
+  prompt. If that prompt was in a toolbar popup that closed before it connected,
+  and the toolbar popup has since been set to open something else, the refused
+  request shows that prompt again.
 - **Elements**:
     - "Connection Request" heading
     - Phishing warning banner (shown when the hostname is on the phishing