fix: preserve Cookie headers in extension requests

[monkeyWie]

Extension fetch and XMLHttpRequest silently dropped Cookie and other headers needed for authenticated downloads after the fetch rewrite. Restore server-side header permissions, including in no-cors mode, expose response cookies, and combine repeated Cookie values with semicolons. Ignore unsupported transport controls and derive Content-Length from the actual request body. Add regression tests that verify headers received by an HTTP server through both APIs, and exclude browser-only WPT restrictions while retaining syntax and immutability coverage.

Stabilize TestFetcher_InitialIgnoredRangeUsesResponseSize, which could fail when Resolve prefetch completed before Start and no Range request was needed. Flush the Resolve headers and hold its body until the Range request arrives so the test always exercises replacement after an ignored Range request. The downloader implementation is unchanged by this test fix.

Validation (Go 1.25.4, matching CI):

• go test ./pkg/download/engine/... -count=1 passed.
• go test ./internal/protocol/http -covermode=count -coverprofile=/tmp/gopeed-http-ci-fix-coverage.out -count=1 passed.
• The ignored-Range test passed 100 consecutive runs with coverage enabled.
• git diff --check passed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.69%. Comparing base (ba84a04) to head (b3f462b).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1581      +/-   ##
==========================================
+ Coverage   70.62%   70.69%   +0.06%     
==========================================
  Files          89       89              
  Lines       14433    14442       +9     
==========================================
+ Hits        10194    10210      +16     
+ Misses       3105     3098       -7     
  Partials     1134     1134              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.