Allow Range header to be set by APIs

This is part of #144.

The aim is to allow APIs to use the Range header for "no-cors"
requests, and allow them to pass through a service worker, but
disallow modification of these requests, and disallow developers
creating their own "no-cors" ranged requests.

Tests: web-platform-tests/wpt#10348.