When `Rack::Response` is initialized with an Array, it incorrectly
increments its internal `@length` value and emitted content-length
header on every subsequent write. The more times `write` is called, the
more the error accumulates.

This commit fixes the accumulation bug, and fixes/adds specs to properly
test the scenario where `write` is used multiple times.

…3.3. (#2143)

Thanks svalkanov

[CVE-2024-26146]

If the sum of the requested ranges is larger than the file itself,
return an empty array. In other words, refuse to respond with any bytes.

[CVE-2024-26141]