Polyfill glMapBufferRange and glUnmapBuffer from GLES 3.

This is a very narrow shim, when glMapBufferRange is (1) write-only, (2) allowed to invalidate the backing buffer, and (3) will flush the buffer upon unmapping, we can shim it. glMapBufferRange mallocs a temporary buffer, and glUnmapBuffer just calls glBufferSubData before freeing it. It's a little gross because glUnmapBuffer doesn't know the original parameters to glMapBufferRange, so we have to track some extra state (AFAICT).