Currently, per spec, if an config-generating API generates a FencedFrameConfig, and the embedder of a fenced frame or even the fenced frame itself "guesses" the urn:uuid backing it, it could navigate the fenced frame to that config.

This doesn't match implementations, and is bad because the intention of a FencedFrameConfig IDL object is to allow only the embedder to navigate the fenced frame with the config object. We should modify the navigation algorithm monkeypatches to be able to accept a FencedFrameConfig object, and only check the fenced frame config mapping if a FencedFrameConfig is supplied to the algorithm, as opposed to if a urn is supplied.

See this comment thread: #183 (comment)