Allow Range header to be set by APIs

This is part of #144.

The aim is to allow APIs to use the range header for no-cors
requests, and allow them to pass through a service worker, but
disallow modification of these requests, and disallow developers
creating their own no-cors ranged requests.

Tests: web-platform-tests/wpt#10348.