fix(desktop): harden external editor and session cookie IPC (#1627)

* fix(desktop): stop the renderer choosing the external editor binary or reading the session cookie

open-external-editor now launches only the editor saved from a file dialog
and refuses to hand executable file types to the OS opener. The unused
get-session-cookie and wait-session-cookie channels, which returned the
httpOnly jwt, are removed.

* fix: validate setting keys before editor authorization

electron/preload.js

@@ -87,16 +87,6 @@ contextBridge.exposeInMainWorld("electronAPI", {
   },
 
   clearSessionCookies: () => ipcRenderer.invoke("clear-session-cookies"),
-  getSessionCookie: (name, targetUrl) =>
-    ipcRenderer.invoke("get-session-cookie", name, targetUrl),
-  waitForSessionCookie: (name, targetUrl, previousValue, timeoutMs) =>
-    ipcRenderer.invoke(
-      "wait-session-cookie",
-      name,
-      targetUrl,
-      previousValue,
-      timeoutMs,
-    ),
 
   externalBrowserLogin: (authUrl, callbackPort) =>
     ipcRenderer.invoke("external-browser-login", authUrl, callbackPort),