Add failing specs for RangeController

for calls to range change listeners when using multiSelect = false, and using the selection of one RangeController as the content of another.

On selection change, all `handle*RangeChange` functions attached to the actual `selection` array are getting called with the original `plus` value, instead of the result of `handleSelectionRangeChange`'s manipulations. This is exhibited clearly in the first spec, and also demonstrated in a "real" example adapted from the repetition.

Thoughts, @kriskowal, @jseidelin ?