Add contextIsolation=true

[amaury1093]

In @ltfschoen's last PR #451, we didn't add contextIsolation=true, because it required a small refactoring in an already-big PR. But according to Electron security guideline, it should be done.

The refactoring consists of:

• using IPC for the communication between main<->preload
• using postMessage for the communication between preload<->react

References:

• Implement Electron security guidelines parity-js/shell#129 (comment)
• Pass down non-serializable objects via webFrame executeJavascript electron/electron#13130 (comment)