HTML parser: fix a regression with foster parenting in foreign content

The regression was introduced in f690ad9
(PR #6399)

For this case:
```
<table><math><p>foo
```
the `<p>` token would not have foster parenting enabled, thus inserting it
into the table.

Fixes #6439.

source

@@ -111065,8 +111065,8 @@ document.body.appendChild(text);
     <span>HTML integration point</span>, or an element in the <span>HTML namespace</span>, pop
     elements from the <span>stack of open elements</span>.</p>
 
-    <p>Process the token <span>using the rules for</span> the "<span data-x="insertion mode:
-    in body">in body</span>" <span>insertion mode</span>.</p>
+    <p>Reprocess the token according to the rules given in the section corresponding to the current
+    <span>insertion mode</span> in HTML content.</p>
    </dd>
 
    <dt>Any other start tag</dt>