Clang is being really peculiar.  Fix with:

-  inline hb_blob_t *sanitize (hb_blob_t *blob) { return c->sanitize<Type> (blob); }
+  inline hb_blob_t *sanitize (hb_blob_t *blob) { return c[0].template/*clang idiosyncrasy*/sanitize_blob<Type> (blob); }

Part of https://github.com/harfbuzz/harfbuzz/issues/1017

For consistency.

* [subset] sanitize individual DeviceRecord's as part of hdmx sanitization.

* [subset] Fix out of bounds read with non-two byte align glyphs.

* [subset] Just use size_device_record >= DeviceRecord::min_size.

* [subset] Add TODO.

* [subset] Re-order checks in hdmx sanitize.

[subset] zero glyf and loca memory before writing so pads are clean. Test just the part of maxp we care about

[subset] sketch out dropping in-glyf instructions. Sometimes yields differnet size glyphs than fonttools, possibly due to padding not being corrected

Was writing source font's offsets. Ouch.

We use calloc() to allocate simple structs and set them to zero.
For bulk memory, use malloc() that doesn't zero.

auto_array has constructor/destructor. Cannot be used in POD object, as the clang
bots all noticed...