fix(web): keep MessagePort resource identifiers private (#36440)