Fix replacement logic when navigating nested browsing contexts
These changes also fix a bug where traversing the session history in a nested browsing context did not update the iframe's contentWindow appropriately.
- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix#22996
- [x] There are tests for these changes
<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/22999)
<!-- Reviewable:end -->