Fix fragment handling regression caused by #10769 (#11686)

Due to the way Window.Location.createUrlBuilder works, a location URI with no
fragment (as opposed to an empty fragment) was sent on Webkit browsers when
the client-side location had an empty fragment.

TestBench test: FragmentChangeEvents.html

Change-Id: Ie2e8dc3fffc13aaa53105b54e07b1f81f3878f1b