Safari Technology Preview 226 breaks espn.com title bar

https://bugs.webkit.org/show_bug.cgi?id=297721
rdar://158951219

Reviewed by Chris Dumez and Anne van Kesteren.

With the Navigation API enabled, the ESPN title bar is empty instead of
containing the tab buttons like it should.

The issue is that espn.com re-assigns the "navigation" variable to hold
these items in this function:

preRender: function(type, navCached, defaultNavData) {
    ...
    navigation = defaultNavData.navigation
    ...
    espn_ui.Helpers.nav.items = navigation.items
    ...
}

But with the Navigation API enabled, the "navigation" variable is reserved
for accessing that API and is not replaceable. So this re-assignment fails
and the title bar ends up empty.

The spec does not say that "navigation" should be replaceable. But this is
breaking a live site and Chrome does allow it to be replaceable, so we fix this
by making it replaceable in WebKit too. I have confirmed that this does fix
the ESPN title bar locally.

Associated spec issue: whatwg/html#11786

I've added a new layout test to check this:
navigation-api/navigation-object-is-replaceable.html

* LayoutTests/imported/w3c/web-platform-tests/interfaces/html.idl:
* LayoutTests/imported/w3c/web-platform-tests/interfaces/html.idl:
* LayoutTests/navigation-api/navigation-object-is-replaceable-expected.txt: Added.
* LayoutTests/navigation-api/navigation-object-is-replaceable.html: Added.
* Source/WebCore/page/DOMWindow.idl:

Canonical link: https://commits.webkit.org/301607@main

Author: RupinMittal

LayoutTests/imported/w3c/web-platform-tests/interfaces/html.idl

@@ -1817,7 +1817,7 @@ interface Window : EventTarget {
   attribute DOMString name;
   [PutForwards=href, LegacyUnforgeable] readonly attribute Location location;
   readonly attribute History history;
-  readonly attribute Navigation navigation;
+  [Replaceable] readonly attribute Navigation navigation;
   readonly attribute CustomElementRegistry customElements;
   [Replaceable] readonly attribute BarProp locationbar;
   [Replaceable] readonly attribute BarProp menubar;

LayoutTests/navigation-api/navigation-object-is-replaceable-expected.txt

@@ -0,0 +1,11 @@
+This tests that the Navigation object is replaceable
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS navigation is not "foo"
+PASS navigation is "foo"
+PASS successfullyParsed is true
+
+TEST COMPLETE
+

LayoutTests/navigation-api/navigation-object-is-replaceable.html

@@ -0,0 +1,12 @@
+<script src="../resources/js-test.js"></script>
+
+<script>
+description("This tests that the Navigation object is replaceable");
+
+window.onload = () => {
+    shouldNotBe("navigation", "\"foo\"");
+    navigation = "foo";
+    shouldBe("navigation", "\"foo\"");
+}
+
+</script>

Source/WebCore/page/DOMWindow.idl

@@ -66,7 +66,7 @@
     [LegacyUnforgeable] readonly attribute Document document;
     attribute [AtomString] DOMString name;
     readonly attribute History history;
-    [EnabledBySetting=NavigationAPIEnabled] readonly attribute Navigation navigation;
+    [EnabledBySetting=NavigationAPIEnabled, Replaceable] readonly attribute Navigation navigation;
     [ImplementedAs=ensureCustomElementRegistry] readonly attribute CustomElementRegistry customElements;
     [Replaceable] readonly attribute BarProp locationbar;
     [Replaceable] readonly attribute BarProp menubar;