geotiff: HTTP range reader does not validate response status, Content-Range, or length

[brendancol]

Describe the bug

xrspatial/geotiff/_reader.py:682 (_HTTPSource.read_range) returns the response body without checking:

• HTTP status (_request only handles 3xx; a 200, 4xx, or 5xx body is returned as-is)
• Content-Range header (a server that ignores Range returns the full object with a 200)
• byte length (a truncated response is passed to the caller)

The caller may waste bandwidth decoding a full-object response under a windowed read, or fail later inside the codec with an error message far from the real cause.

Expected behavior

read_range should:

1. Require status 206 (or 200 with a server-side range guarantee), otherwise raise.
2. Verify Content-Range: bytes <start>-<end>/<total> matches the request when present.
3. Verify returned byte length equals the requested length, otherwise raise with the actual vs expected count.