ci: tell twine upload to --skip-existing

setup.cfg: .tar.gz is now mandatory, no more .zip for sdist

Merge pull request #1163 from googlefonts/allow-empty-non-default-glyphs

fix flake8 B042 error

compatibility checker: allow non-default empty glyphs (treat as sparse)

add more test glyphs to IncompatibleSans

remove test_instantior.py, already tested in ufo2ft

bump fonttools and ufo2ft

Merge pull request #1154 from googlefonts/dont-use-my-metrics-for-vfs

test different defaults for static vs variable and CLI flag overrides

Merge remote-tracking branch 'origin/main' into dont-use-my-metrics-for-vfs

Merge pull request #1155 from googlefonts/bump-requirements

Bump all dependencies, require Python 3.9+

Pass auto_use_my_metrics=False to ufo2ft for variable fonts

oops, need to set 'permissions' key one level up in the github yml