Auto merge of #22999 - jdm:iframe-replace, r=asajeffrey,cbrewster

Fix replacement logic when navigating nested browsing contexts

These changes also fix a bug where traversing the session history in a nested browsing context did not update the iframe's contentWindow appropriately.

- [x] `./mach build -d` does not report any errors
- [x] `./mach test-tidy` does not report any errors
- [x] These changes fix #22996
- [x] There are tests for these changes

<!-- Reviewable:start -->
---
This change is [<img src="https://reviewable.io/review_button.svg" height="34" align="absmiddle" alt="Reviewable"/>](https://reviewable.io/reviews/servo/servo/22999)
<!-- Reviewable:end -->

components/script/dom/htmliframeelement.rs

@@ -278,9 +278,7 @@ impl HTMLIFrameElement {
         // see https://html.spec.whatwg.org/multipage/#the-iframe-element:about:blank-3
         let is_about_blank =
             pipeline_id.is_some() && pipeline_id == self.about_blank_pipeline_id.get();
-        // Replacement enabled also takes into account whether the document is "completely loaded",
-        // see https://html.spec.whatwg.org/multipage/#the-iframe-element:completely-loaded
-        let replace = is_about_blank || !document.is_completely_loaded();
+        let replace = is_about_blank;
         self.navigate_or_reload_child_browsing_context(
             Some(load_data),
             NavigationType::Regular,