WPT fetch api tests

[npaun]

This is a giant one (and it's still a draft), so I'd suggest reviewing commit-by-commit.

Improvements to Bazel config for WPT tests:

• By fiddling with the arguments passed, we can calculate relative paths in a less brittle manner.
• Add the WPT CA certificate and enable network connections for WPT tests.

Improvements to the test harness:

• Better relative path logic here too. Trying to make a flat namespace like workerd bindings act like a file system willo always be clunky, but now stuff like '../resources/xhr.js` can be interpreted correctly.
• Added several new harness functions: assert_greater_than, assert_regexp_match, promise_rejects_js, promise_rejects_exactly, add_cleanup/add_completion_callback.
• Made tests involving fetching from an external server work properly. We also support relative URLs and give WPT tests a fake sense of location (http://localhost:8000/path/to/test.js, etc.)
• @anonrig suggested a much nicer way to keep test files from polluting the global scope - just put the source code inside braces to create a scope, then eval.

Added a config file for the fetch/api tests.

We fail most of them. Here's a really quick summary of why:

• Many of them fail for pretty trivial reasons. e.g. We should set Response.type to basic in a lot of cases, we forget to put a space in multipart/form-data;boundary=whatevs, we force ReadableStreams to explicitly set type: undefined instead of allowing a missing property, and such.
• Lots of tests are not relevant because they bring in CORS, forbidden headers, etc.
• A few tests seem to trigger some kind of broken state in libkj 😱. We get spurious Invalid response status line (invalid protocol). messages, and they don't seem to actually be associated with the request that caused them. I'm still looking into this. Curious if ASan sees anything...
• Please comment on a particular test case if you need more info on why it's failing, or have ideas about what we should prioritize fixing.

Next step

• I'm testing this by manually standing up a WPT server then calling bazel test. I'll need to use @anonrig's sidecar option to launch the wpt server before the tests are run.
• Improving sidecar (I'll create an issue for this.)

[anonrig]

Can you add an example which test depends on this?

[npaun]

...