Crash: Move crash reporting state to DocumentAssociatedData

Before this CL, the crash storage map was stored on RenderFrameHostImpl,
which meant that in certain same-site navigation scenarios where a
RenderFrameHostImpl could span two sequential documents (captured by
`ShouldCreateNewRenderFrameHostOnSameSiteNavigation()`), this crash data
would be mistakenly carried over to the next document, and
renderer/browser state would by de-synchronized.

This CL fixes this by moving the crash storage map over to
DocumentAssociatedData, to keep the necessary state synced up.

This CL is a follow-up to
https://chromium-review.googlesource.com/c/chromium/src/+/6819100/comment/c7fa6e18_07ef63be/.

R=alexmos

Bug: 400432195
Change-Id: I1007b5e78536047544934db37e89f11e7fce21b6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6838240
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Commit-Queue: Dominic Farolino <dom@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1500291}