fix: enhance PDF viewer security by removing file parameters and validating URLs

[papphelix]

This pull request is to fix the file param in URL which is creating security issue by sending arbitrary data in query param which can put cms under risk of different attacks like

• random load which is read
• xss attack if pdf.js is not handling properly while reading file param

Issue Screenshots:

Fixes done:

• Removed File param from iframe src
• Added postmessage based communication to pass on file path for loading the PDF on the pdf.js
• When the url of iframe is opened it will always show chapters first pdf by default.

pdf-file-param-removal.mov