Function EvaluateWidgetSubmitMessage

Host-side validation of one window 'message' event:

1. the payload must carry the WHITEBOARD_SUBMIT_MARKER (anything else is unrelated postMessage traffic — dropped silently as 'not-submit');
2. sourceWidget is the caller's resolution of event.source against its tracked widget iframes (window → item map) — null means the sender is NOT one of the board's widgets and the message is dropped ('unknown-source');
3. the submitted data is JSON-serialized and capped at WHITEBOARD_WIDGET_SUBMIT_MAX_CHARS ('oversize' beyond it).