Add last-event-id to CORS-safelisted request headers

Since EventSource implementations in most environments already send this header
without CORS preflight request, it makes sense to make it a safelisted header.

Fixes #568

Author: rexxars

fetch.bs

@@ -984,6 +984,7 @@ is a <dfn export>CORS-safelisted request-header</dfn>, run these steps:
 
   <dl class=switch>
    <dt>`<code>accept</code>`
+   <dt>`<code>last-event-id</code>`
    <dd>
     <p>If <var>value</var> contains a <a>CORS-unsafe request-header byte</a>, then return false.