UpdateRender() will destroy the Browser window, which was created due to Navigate
causing the addon to see a valid Browser but then destroy it out from under the
addon on the Cef thread without it knowing that it is even coming.

Instead only UpdateRender() from Navigate() which the addon can overload and
observe happening.

This also avoids loading the url twice on startup, once from setting the Url
and once from the form load afterward.

This returns a List<CefBrowser> instead of storing only a single
CefBrowser. However there are some key differences from before to
address threading.
- The whole list of browsers is not exposed outside of the Renderer
class, because browsers after the first in the list can be added
*and removed* at any time on the Cef UI thread.
- Any use of the list is still guarded by a semaphore, but also any
use of a browser that is not the first in the list must also be
guarded by the semaphore to prevent it from being destroyed on the
Cef thread while it is being used elsewhere.
- The list is never null, only empty or non-empty for simplicity to
avoid two empty states.
- The first browser in the list acts like the single CefBrowser var
did. When the first browser is added to the list on the Cef UI
thread, it will remain the first browser in the list and not be
removed until a navigation which removes it (and all browsers)
on the main thread. This means we can still return the first
browser in the list outside the class, and expose it as |Browser|.