Default features only for now.

We expect buffer to be setup with default positions before GPOS.

The array query APIs now all do:

  - Return the total number of items
  - Take a start_offset, such that individual items can be fetched
  - The _count IN/OUT variable always has number of items written
    into the array upon return of the function

Reported by Keith Stribley on HarfBuzz list.

Fix off-by-one.

That function doesn't make much sense as multiple features in the table may
have the same tag.

This reverts commit c939f6aff405ca7b10b1f1538f46148bff719fcb.