Specify a navigated-to new document's URL

The "URL that was originally to be fetched" isn't clear about which URL
that actually was. This makes it clear that we use the request's current
URL when available, or the response's URL when not.

For javascript: URLs, this fixes them to match 2/3 browser behavior.
6440cca regressed the algorithm by
deleting the actual usage site of the address variable. This change
reintroduces the use of address, although in a simpler way, by appending
address to the request's URL list, instead of using the "override URL"
concept which was removed.

Fixes #3953.

Closes #1565 by preserving the special case; discussions there and in
https://bugzilla.mozilla.org/show_bug.cgi?id=1281375#c7 indicate that
the special case is more web-compatible.

Tests:

* https://github.com/web-platform-tests/wpt/blob/7ed525acfb4133c1177fdb1ff8477e2a6469e6b4/html/browsers/history/the-location-interface/location_hash.html#L24
* https://github.com/web-platform-tests/wpt/blob/7ed525acfb4133c1177fdb1ff8477e2a6469e6b4/html/semantics/embedded-content/the-iframe-element/iframe_javascript_url_01.htm
* web-platform-tests/wpt#14288
* web-platform-tests/wpt#14316

source

@@ -2796,6 +2796,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
        <li><dfn data-x="concept-request-header-list" data-x-href="https://fetch.spec.whatwg.org/#concept-request-header-list">header list</dfn></li>
        <li><dfn data-x="concept-request-body" data-x-href="https://fetch.spec.whatwg.org/#concept-request-body">body</dfn></li>
        <li><dfn data-x="concept-request-client" data-x-href="https://fetch.spec.whatwg.org/#concept-request-client">client</dfn></li>
+       <li><dfn data-x="concept-request-url-list" data-x-href="https://fetch.spec.whatwg.org/#concept-request-url-list">URL list</dfn></li>
        <li><dfn data-x="concept-request-current-url" data-x-href="https://fetch.spec.whatwg.org/#concept-request-current-url">current URL</dfn></li>
        <li><dfn data-x="concept-request-reserved-client" data-x-href="https://fetch.spec.whatwg.org/#concept-request-reserved-client">reserved client</dfn></li>
        <li><dfn data-x="concept-request-replaces-client-id" data-x-href="https://fetch.spec.whatwg.org/#concept-request-replaces-client-id">replaces client id</dfn></li>
@@ -82005,6 +82006,9 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
        <li><p>Let <var>address</var> be the <span data-x="concept-document-url">URL</span> of the
        <span>active document</span> of <var>browsingContext</var>.</p></li>
 
+       <li><p>Append <var>address</var> to <var>resource</var>'s <span
+       data-x="concept-request-url-list">URL list</span>.</p></li>
+
        <li><p>Let <var>settings</var> be the <span>relevant settings object</span> for the
        <span>active document</span> of <var>browsingContext</var>.</p></li>
 
@@ -82419,8 +82423,13 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
 
     <p><dfn data-x="set the document's address">Setting the document's address</dfn>: Any
     <code>Document</code> created by these steps must have its <span
-    data-x="concept-document-url">URL</span> set to the <span>URL</span> that was originally to be
-    fetched, ignoring any other data that was used to obtain the resource.</p>
+    data-x="concept-document-url">URL</span> set to:</p>
+    <dl class="switch">
+     <dt>If <var>request</var> is non-null,</dt>
+     <dd><var>request</var>'s <span data-x="concept-request-current-url">current URL</span></dd>
+     <dt>Otherwise (<var>request</var> is null),</dt>
+     <dd><var>response</var>'s <span data-x="concept-response-url">URL</span></dd>
+    </dl>
 
     <p><!--en-GB--><dfn id="initialise-the-document-object" data-x="initialize the Document object"
     data-export="">Initializing a new <code>Document</code> object</dfn>: when a