Move location.fragmentDirective to document.fragmentDirective

[bokand]

See https://crbug.com/1057795 and whatwg/html#5523

Basically, window.location is special in all kinds of ways and is spec'd to represent the URL of its document's browsing context's active document, not the Document itself. If we start adding things to fragmentDirective this would allow cross-origin access to values which is bad.

Moving fragmentDirective to live on document seems like a more safe and natural place for it.

[tomayac]

FYI, updated the article accordingly: GoogleChrome/web.dev#3661.