Use relevant settings object for pushState/replaceState URL parsing

Tested by https://url-parsing-entry-iaqyojravh.now.sh/entry/entry.html;
all browsers use relevant, instead of entry, at least for URL parsing.
Further testing is needed for the origin checks.

Part of #1431.

source

@@ -80683,8 +80683,8 @@ interface <dfn>History</dfn> {
    methods that are invoked on a timer, or from event listeners that are not triggered in response
    to a clear user action, or that are invoked in rapid succession.)</p></li>
 
-   <li><p>Let <var>targetRealm</var> be this <code>History</code> object's <span>relevant settings
-   object</span>'s <span data-x="environment settings object's realm">Realm</span>.</p></li>
+   <li><p>Let <var>targetRealm</var> be this <code>History</code> object's <span
+   data-x="concept-relevant-realm">relevant Realm</span>.</p></li>
 
    <li><p>Let <var>cloned data</var> be <span>StructuredClone</span>(<var>data</var>,
    <var>targetRealm</var>). Rethrow any exceptions.</p></li>
@@ -80696,7 +80696,7 @@ interface <dfn>History</dfn> {
     <ol>
 
      <li><span data-x="parse a url">Parse</span> the value of the third argument, relative to the
-     <span>entry settings object</span>.</li>
+     <span>relevant settings object</span> of this <code>History</code> object.</li>
 
      <li>If that fails, throw a <span>"<code>SecurityError</code>"</span> <code>DOMException</code>
      and abort these steps.</li>