Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11034

Ugly as hell, and don't even understand why some bits are needed.
But the logic is sound.

It has unbounded size...

Fixes https://oss-fuzz.com/v2/testcase-detail/5718889451749376

Unfortunately our static asserts (DEFINE_SIZE_STATIC) don't actually
fail when used in templates, thanks to SFINAE.  Le sighs.

Probably fixes https://oss-fuzz.com/v2/testcase-detail/5740171484463104

Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=10897

Works beautifully!  Test coming.

Tested with Kannada MN:

$ HB_OPTIONS=aat ./hb-shape Kannada\ MN.ttc -u 0CCD,0C95,0CD6
[kn_ka.vattu=0+230|kn_ai_length_mark=1@326,0+607]

For 329f2401

max_ops is signed.

Since we consume it legitimately during shaping.

Not hooked up to be called yet.

If buffer was enlarged, info was being outdated.

Fixes https://github.com/harfbuzz/harfbuzz/issues/1225

Was getting stuck not making progress somehow.

...like UnsizedArrayOf<>.

This fixes a class of crasher bugs, mostly with color and AAT tables.  We
cannot use nullable offsets to varsized data that does not declare min_size,
because it's nost safe to use our fixed-size null pool for types that have
their size external.  So, use non_null'able offsets for these.

A further enhancement would be to make use of min_size in Null<> itself.
Will try that after.

Not sure how I didn't add before...

Fix a bug in CBDT sanitize, and redundant check in avar.

Sorry for the noise, downstream custom builders.  Please adjust.

We should hang those off somewhere else. For now, the unused ones can go.

I believe I'm happy with it now.