Handle Cookies properly

[MarcoPolo]

...and perhaps other forbidden headers.

This library uses the standard Request/Response types. One limitation of those types is that we don't get access to the Cookie headers. Which means we don't do the same thing the browser does with "Set-Cookie" and sending "Cookie" headers.

Not handling cookies means that some common auth patterns don't work in the HTTP over libp2p stream scenario. Which goes against the goal of being indistinguishable from the browser's native fetch.

We can work around these limitations because at the end of the day we are the ones writing and reading the raw HTTP messages. We can implement our own "cookie store" that maps from a peer to a set of cookies. We can attach the cookies on outgoing requests just as the browser does.

This should be relatively straightforward.