DocumentLoader: commit navigation synchronously

We used to commit navigation after receiving the first byte of
document response. This CL moves commit earlier, synchronously done
from CommitNavigation call. The change should not be web-observable,
but some internal assumptions may have been affected.

Test changes:
- ReplacingDocumentLoaderFiresLoadEvent was testing the old behavior,
  which is not applicable anymore.
- MultiChunkWithReentrancy now uses a different method to trigger
  reentrancy (pdf plugin), since we no longer commit after first byte.
- backdrop-object.html and anchor-change-href.svg relied on test finishing
  late enough, now they wait for onload to eliminate a race.
- use-property-synchronization-crash.html now reports an error message
  synchronously and therefore has JS stack and a line number.
- setting-allowpaymentrequest-timing.https.sub.html has a race as
  explained here [1], and now fails even without site isolation.

This corresponds to the step 8.b from the doc linked to the bug.

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=819800#c6

Bug: 855189

Change-Id: I0bdb32b9ac5245ddb81c2f77b41ea762d58ce526
Reviewed-on: https://chromium-review.googlesource.com/c/1399447
Commit-Queue: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Camille Lamy <clamy@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#636994}
7 files changed