Request: implement remaining RequestInit members and state

Related: #689

The Request implementation currently omits the Fetch/Web IDL state and constructor behavior for referrer, referrerPolicy, signal, duplex, priority, and window. This issue tracks implementing those members as real request state rather than silently reading or ignoring them.

Standards: https://fetch.spec.whatwg.org/#request-class and https://webidl.spec.whatwg.org/#js-dictionary

Acceptance

• RequestInit conversion includes every current standard member in Web IDL dictionary order.
• referrer/referrerPolicy parsing and getters follow Fetch.
• signal is validated, followed, and cloned with the required dependent signal semantics.
• duplex, priority, and window conversion/validation follow current Fetch requirements.
• constructor, copy-construction, and clone preserve all state with exact observable ordering.
• Focused and full unit/TSan coverage plus relevant web-platform differential evidence are recorded.

This issue excludes promise/job/queue scheduling internals except where an AbortSignal state transition is synchronously required by Fetch.

While auditing the remaining RequestInit state against Fetch/WPT, I split the independent Headers guard security boundary into #691. #690 remains scoped to referrer/referrerPolicy, dependent AbortSignal state, duplex/priority/window conversion, and exact constructor/copy/clone ordering.

Implemented and pushed directly to main in 41639826.

This completes the current RequestInit surface in Web IDL member order; adds referrer/referrerPolicy, signal, duplex, priority, and navigation-state behavior; creates fresh dependent signals for construction and cloning with exact reason propagation; and enforces stream/duplex, keepalive, mode, locked, and disturbed-body constraints without preventing a valid body replacement.

Evidence:

• focused RequestInit state: 1/1 in Debug, forced-flat, ReleaseSafe, and TSan
• constructor conversion ordering: 1/1
• C API ReadableStream Request lifecycle: 1/1
• full unit suite: 1784 passed, 1 skipped, 0 failed, 0 leaked
• Test262 flips: 0; Fetch Request has no matching Test262 corpus files

The focused coverage follows the current Fetch Standard and the relevant WPT cases: request-init-stream.any.js, general.any.js, request-init-001.sub.html, and request-structure.any.js. The header-guard security boundary remains separately tracked in #691.