Add alternative mechanism of communicating into a *WebView.

Change the location URL fragment and observe the change via a "hashchange"
event on the JS side.

In theory this should have lower overhead than
stringByEvaluatingJavaScriptFromString:/evaluateJavaScript:completionHandler:
since itwe don't need to do arbitrary JS parsing (we can just JSON-encode the
data in). In practice it ends up being slower since the URL fragment change
triggers the (navigation) delegate's shouldStartLoadWithRequest:/
decidePolicyForNavigationAction: methods, incurring an additional roundtrip.