[CFF] oss-fuzz issue 11714: set_blends

[CFF] oss-fuzz issue 11713 (CFF2VariationStore::serialize)

[CFF] fix oss-fuzz issue 11691 (BlendArg::set_blends)

[CFF] fix oss-fuzz issue 11674: parse_bcd

[CFF] fix oss-fuzz issue 11675 (ASSERT: count <= str.len)

Also added an additional error check to avail ()

Related to https://github.com/harfbuzz/harfbuzz/issues/1337

May used in addition to an API related to STAT.

Lots of Apple fonts have it.

May or may not be used in https://github.com/harfbuzz/harfbuzz/pull/1432

[CFF] fix for oss-fuzz 11657: Charset overrun

[CFF] fix leak: oss-fuzz 11662

* guard against no subr access

* code tweak

* add minimized testcase for oss-fuzz 11670 (Null deference)

Check overrun in Charset1_2::get_glyph