Restore override URL concept for javascript: URLs

This concept was deleted in 6440cca along with "overridden overload",
but it was discovered in whatwg#3989 that correct handling for javascript:
URLs still depend on this concept. The spec around this area has changed
quite a bit since then due to intermediate cleanups such as e13762f,
so this is not a simple revert.

Also, fix ungrammatical "append URL URL list" that was accidentally
introduced in e13762f.

Addresses some concern raised in whatwg#3989.

source

@@ -83493,9 +83493,11 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
       https://software.hixie.ch/utilities/js/live-dom-viewer/?saved=2640 -> javascript:'test' in Firefox, about:blank otherwise
      -->
 
-     <li><p><span data-x="list append">Append</span> the <var>browsingContext</var>'s <span>active
-     document</span>'s <span data-x="concept-document-url">URL</span> <span
-     data-x="concept-request-url-list">URL list</span>.</p></li>
+     <li><p>Let <var>address</var> be <var>browsingContext</var>'s <span>active document</span>'s
+     <span data-x="concept-document-url">URL</span>.</p></li>
+
+     <li><p><span data-x="list append">Append</span> <var>address</var> to <var>request</var>'s
+     <span data-x="concept-request-url-list">URL list</span>.</p></li>
 
      <li><p>Let <var>settings</var> be <var>browsingContext</var>'s <span>active document</span>'s
      <span>relevant settings object</span>.</p></li>
@@ -83527,6 +83529,9 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
       bytes that comprise a <span data-x="concept-response-body">response body</span> is not yet
       specified, pending further investigation into user agent behavior. See <a
       href="https://github.com/whatwg/html/issues/1129">issue #1129</a>.</p>
+
+      <p>When it comes time to <span>initialize the <code>Document</code> object</span>, use
+      <var>address</var> as the <span>override URL</span>.</p>
      </li>
     </ol>
    </li>
@@ -83582,9 +83587,17 @@ interface <dfn>Location</dfn> { // but see also <a href="#the-location-interface
     </ol>
    </li>
 
-   <li id="set-the-document's-address"><p>If <var>request</var> is non-null, then set
-   <var>document</var>'s <span data-x="concept-document-url">URL</span> to <var>request</var>'s
-   <span data-x="concept-request-current-url">current URL</span>.</p></li>
+   <li id="set-the-document's-address">
+    <p>If an <dfn>override URL</dfn> is set for this navigation, then set <var>document</var>'s
+    <span data-x="concept-document-url">URL</span> to the <span>override URL</span>.</p>
+
+    <p class="note">An <span>override URL</span> is set when <span data-x="javascript
+    protocol">executing a <code>javascript:</code> URL request</span>.</p>
+   </li>
+
+   <li><p>Otherwise, if <var>request</var> is non-null, then set <var>document</var>'s <span
+   data-x="concept-document-url">URL</span> to <var>request</var>'s <span
+   data-x="concept-request-current-url">current URL</span>.</p></li>
 
    <li><p>Otherwise, set <var>document</var>'s <span data-x="concept-document-url">URL</span> to
    <var>response</var>'s <span data-x="concept-response-url">URL</span>.</p></li>