Headers: enforce Request guards and no-CORS mutation rules

Related: #689, #690, #473

Request construction currently clones and exposes a Headers object without the Fetch Standard request/request-no-cors guard state. That leaves forbidden request headers and no-CORS-unsafe mutations outside the required security boundary.

Standards: https://fetch.spec.whatwg.org/#concept-headers-guard and https://fetch.spec.whatwg.org/#headers-class

Acceptance

• Headers objects carry real none, request, request-no-cors, response, and immutable guard state where required.
• Request construction and cloning install the correct guard before filling/sanitizing headers.
• append, set, delete, and fill enforce forbidden request-header and no-CORS-safelisted rules, including privileged Range cleanup.
• Guard state is internal, clone-safe, and synchronized under shared-realm mutation.
• Focused Fetch/WPT-derived tests cover constructor sanitization and post-construction mutation in normal and no-cors modes.
• Full unit and TSan gates pass with measured evidence.

Implemented and landed on main in 1a0cc2be.

The native header record now models all five Fetch guards (none, request, request-no-cors, response, and immutable) and applies forbidden-name, method-override, no-CORS safelist/combined-value, and privileged Range cleanup rules atomically under the existing record lock. Request and Response construction, cloning, static factories, and JavaScript mutators now install or preserve the correct guard. Header conversion also follows Web IDL ByteString semantics without lossy UTF-8 workarounds.

Validation:

• WPT-derived JavaScript guard coverage: 2/2 Debug, 2/2 forced-flat, 2/2 ReleaseSafe, 2/2 TSan
• Native guard coverage: 3/3 Debug; no-CORS synchronization coverage 2/2 TSan
• Full Debug suite: 1789 passed, 1 skipped, 0 failed, 0 leaked (6 shards)
• Full TSan suite: 1788 passed, 2 skipped, 0 failed, 0 leaked (6 shards)
• Exact Test262 filename inventory for Request, Headers, and Response: zero files, so this changes 0 measured Test262 cases

The focused cases are derived from the Fetch Standard algorithms and the relevant WPT Headers/Response guard tests.