<!--
  Please provide a clear and concise description of what the bug is. Include
  screenshots if needed. Please test using the latest version of the relevant
  React packages to make sure your issue has not already been fixed.
-->

React version: 18.3.0-canary-493f72b0a-20230727

## Steps To Reproduce

1.  run following code.
```js
import * as ReactDOMServer from "react-dom/server";
const element = (
  <html>
    <head>
      {/* meta and title are hoisted */}
      <meta charSet="utf-8" />
      <title>title</title>
      {/* the script tag is not hoisted */}
      <script src="foo"></script>
      {/* but this is hoisted */}
      <script src="foo" async></script>
    </head>
  </html>
);

console.log(ReactDOMServer.renderToString(element));
```

<!--
  Your bug will get fixed much faster if we can run your code and it doesn't
  have dependencies other than React. Issues without reproduction steps or
  code examples may be immediately closed as not actionable.
-->

Link to code example:
https://codesandbox.io/s/react1830-canary-493f72b0a-20230727-ssr-hoist-bug-lvhj45?file=/src/index.js
<!--
  Please provide a CodeSandbox (https://codesandbox.io/s/new), a link to a
  repository on GitHub, or provide a minimal code example that reproduces the
  problem. You may provide a screenshot of the application if you think it is
  relevant to your bug report. Here are some tips for providing a minimal
  example: https://stackoverflow.com/help/mcve.
-->

## The current behavior
console.log outputs `<meta charSet="utf-8"/><script src="foo" async=""></script><title>title</title><html><head><script src="foo"></script></head></html>`

## The expected behavior
console.log outputs `<html><head><meta charSet="utf-8"/><title>title</title><script src="foo"></script><script src="foo" async=""></script></head></html>`
target.push(endOfStartTag);
  return null;
}
function pushTitle(
  target: Array<Chunk | PrecomputedChunk>,
  props: Object,
  responseState: ResponseState,
  insertionMode: InsertionMode,
  noscriptTagInScope: boolean,
): ReactNodeList {
  if (__DEV__) {
    if (hasOwnProperty.call(props, 'children')) {
      const children = props.children;
      const child = Array.isArray(children)
        ? children.length < 2
          ? children[0]
          : null
        : children;
      if (Array.isArray(children) && children.length > 1) {
        console.error(
          'React expects the `children` prop of <title> tags to be a string, number, or object with a novel `toString` method but found an Array with length %s instead.' +
            ' Browsers treat all child Nodes of <title> tags as Text content and React expects to be able to convert `children` of <title> tags to a single string value' +
            ' which is why Arrays of length greater than 1 are not supported. When using JSX it can be commong to combine text nodes and value nodes.' +
            ' For example: <title>hello {nameOfUser}</title>. While not immediately apparent, `children` in this case is an Array with length 2. If your `children` prop' +
            ' is using this form try rewriting it using a template string: <title>{`hello ${nameOfUser}`}</title>.',
          children.length,
        );
      } else if (typeof child === 'function' || typeof child === 'symbol') {
        const childType =
          typeof child === 'function' ? 'a Function' : 'a Sybmol';