Two related performance fixes for the HTTP COG read path.

P2 -- range coalescing. _read_cog_http used to fire one GET Range:
request per tile through an 8-worker pool, so wall time scaled as
ceil(N_tiles / 8) * RTT. COG tiles are stored sequentially, so a new
helper coalesce_ranges merges adjacent (offset, length) entries whose
gap is below a threshold (default 1 MB, configurable via
XRSPATIAL_COG_COALESCE_GAP) and split_coalesced_bytes slices the
returned bytes back per-tile. _HTTPSource grows a read_ranges_coalesced
wrapper that calls the existing read_ranges underneath. On a 50 ms
RTT mocked link with 64 tiles the un-coalesced path takes ~450 ms; the
coalesced path takes ~100 ms and issues 2 GETs instead of 65.

P5 -- once-per-graph IFD parsing. read_geotiff_dask used to call
read_to_array per chunk, which on HTTP routed through _read_cog_http
and fired a fresh 16 KB header GET each time. The IFD parse is now
factored into _parse_cog_http_meta and the tile fetch into
_fetch_decode_cog_http_tiles (which honours a window). read_geotiff_dask
parses metadata once before constructing the dask graph and threads the
parsed (header, ifd) into delayed tasks via an http_meta kwarg. A
16-chunk dask graph now issues a single 16 KB header GET instead of
one per chunk.

Public API is unchanged. Existing test_cog_http_concurrent suite still
passes; new tests live in test_http_cog_coalesce.py.

Three findings, all acted on:

- _parse_cog_http_meta retry comment claimed "If we didn't get all
  IFDs, try a larger fetch" but the gate is `len(ifds) == 0`, not
  partial-IFD recovery. Reword the comment to match: parse_all_ifds
  bails when the header GET lands short of the first IFD offset,
  and the retry expands the window in that one case. Overviews
  past the first 16 KiB still come from later reads.
- _read_tiles now skips the full-image _check_dimensions(width,
  height, ...) gate when a window is provided. With the windowed
  HTTP path, dask-chunked reads of multi-billion-pixel COGs only
  materialise the window; the full-image cap was rejecting
  legitimate reads. The single-tile budget always applies, and the
  full-image cap still applies for whole-file reads (window is
  None) and the windowed output cap (out_h * out_w * samples) is
  unchanged.
- read_geotiff_dask wraps the parsed (TIFFHeader, IFD) in a single
  dask.delayed key (`http_meta_key`) and threads it as a function
  argument into _delayed_read_window's inner @dask.delayed task,
  rather than capturing it via Python closure. Distributed/process
  schedulers now serialise the metadata once across the whole
  graph instead of once per chunk. On COGs with millions of tiles
  (and correspondingly large TileOffsets/TileByteCounts tuples in
  the IFD) this saves O(N_chunks) of redundant pickle work.