Add a resume commit closure field to NavigationRequest.

If the browser process has asked a speculative RenderFrameHost to commit
a navigation, but the renderer has not yet confirmed the commit, a
subsequent navigation should wait for it to finish before trying to
proceed.

However, if Chrome needs to discard the speculative RenderFrameHost for
some reason, it currently does not actually wait for the pending commit
to complete; this can result in a desync between the browser and
renderer and is the root cause of https://crbug.com/838348.

There is a "temporary" workaround for this crash that attempts to undo
an already-committing navigation if a speculative RFH in this state
needs to be discarded; however, it is imperfect, and incompatible with
RenderDocument.

This resume commit closure will be used in followup CLs to allow
navigation requests blocked in this state to set up a closure that
resumes committing the navigation when called.

Bug: 1220337
Change-Id: I9aa599877df61e9903f0dcecaec4ebdc553ce813
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4130115
Reviewed-by: Rakina Zata Amni <rakina@chromium.org>
Commit-Queue: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1090550}