Change local storage to session storage for keys

[leeland-turnkey]

Switch embedded key storage from localStorage to sessionStorage in the export-and-sign iframe.

setItemWithExpiry, getItemWithExpiry, and onResetEmbeddedKey now use sessionStorage instead of localStorage
Settings remain in localStorage (non-sensitive, can be shared across tabs)

localStorage is shared across all browser tabs with the same origin, causing embedded keys to leak between tabs. When users open multiple tabs of the same parent website, all iframe instances were sharing the same embedded key, creating a security issue.
Using sessionStorage provides tab isolation. Each tab now has its own isolated embedded key, preventing cross-tab key leakage while maintaining HPKE security properties.

Concerns
Since we are switching to sessionStorage, keys will be lost upon page refresh. Users will have to re-inject bundles after refreshing the page.