fix: cookies and immutable headers (#13942)

* Add Cookie Error

When making a request via the event.fetch to the same exact domain the svelte app is running on, it fails returning a 500 due to the header being immutable.

This only happens when a cookie is set in the hooks before trying to make a request with the event.fetch

* Add Changeset

* Update .changeset/breezy-poets-grow.md

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

* Sub Requests have immutable headers

From my testing, all sub requests have immutable errors and will fail if cookies are added to them. This will add a check to skip adding the cookies if it is a sub request.

* New Response Object

Use a new response object to avoid the headers being immutable when adding new cookies.

* Format

* New Response Object v2

Looked more at other code and found another place where a new response object is created. I based these changes on that to limit the amount of code being changed.

* Update .changeset/breezy-poets-grow.md

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>

* Only create copy if it is from fetch

* Update packages/kit/src/runtime/server/respond.js

* tweak

* Update .changeset/breezy-poets-grow.md

---------

Co-authored-by: Ben McCann <322311+benmccann@users.noreply.github.com>
Co-authored-by: Rich Harris <rich.harris@vercel.com>
Co-authored-by: Rich Harris <hello@rich-harris.dev>

Author: 3 people

.changeset/breezy-poets-grow.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: clone `fetch` responses so that headers are mutable

packages/kit/src/runtime/server/respond.js

@@ -682,7 +682,10 @@ export async function internal_respond(request, options, manifest, state) {
 
 			// we can't load the endpoint from our own manifest,
 			// so we need to make an actual HTTP request
-			return await fetch(request);
+			const response = await fetch(request);
+
+			// clone the response so that headers are mutable (https://github.com/sveltejs/kit/issues/13857)
+			return new Response(response.body, response);
 		} catch (e) {
 			// TODO if `e` is instead named `error`, some fucked up Vite transformation happens
 			// and I don't even know how to describe it. need to investigate at some point