Fix fragment handling regression caused by #10769 (#11686)

Due to the way Window.Location.createUrlBuilder works, a location URI with no
fragment (as opposed to an empty fragment) was sent on Webkit browsers when
the client-side location had an empty fragment.

TestBench test: FragmentChangeEvents.html

Change-Id: Ie2e8dc3fffc13aaa53105b54e07b1f81f3878f1b
Merged changes from origin/7.0

9c6d4b4 Fix fragment handling regression caused by #10769 (#11686)

Change-Id: I5050ec03b1f97c1da7aa6bbbc3718635fe7f6102