fix(renderer): reject javascript: location assignments without ghosting href

[BibekPathak]

Assigning window.location (or location.href) to a javascript: URL on a
top-level window wrote the raw "javascript:..." string into the location
href slot and recorded a pending top-level navigation. On delegate pages
(plain Runtime.evaluate) that navigation is never published or followed, so
location.href was left in a "ghost" state showing the javascript: string
without ever navigating, and the pending record was never cleared.

Match Chromium: leave location.href unchanged and drop the navigation
cleanly. Script execution remains intentionally absent.

• Stop syncing the location object when the resolved target scheme is
  "javascript" (top-level path already mirrored the child-frame guard), so
  the assignment is a synchronous no-op for href.
• Clear the pending navigation and restore the top-level location/document
  state when a javascript: pending navigation is dropped on the delegate
  path, instead of silently returning None with the record left behind.

The follow path is unaffected: it executes javascript: navigations inline
via take_pending_location_navigation_with_seed and never goes through the
non-javascript filter.

Tests: add a vm-level test asserting href stays unchanged, the pending
navigation is retained until dropped, and publication clears it; add a
delegate-page CDP test asserting location.href and document.title are
unchanged after a javascript: assignment.

[BibekPathak]

@ldm0 check this out