[cff] Use CheckOffset to validate private_offset.

[colr] Avoid double-reading the base glyph list entries

[silf] Fix undefined behavior: unique_ptr<T> with new T[]

[variations] Fix intermediate region validation checking zeros

[layout] Fix off-by-one in glyph ID validation checks

[cff] Fix missing sign extension for charstring opcode 28

[cmap] Fix off-by-one in format 12 glyph ID validation

[cff] Fix wrong formula for negative DICT integers (b0 in [251,254])

[cff] Fix BCD real number high nibble never being validated

[colr] Limit nesting depth of COLRv1 paint tables.

Introduce new TABLE_ACTION_SANITIZE_SOFT action.

ots-idempotent.cc: Use `result2` correctly

[ci] Update upload-artifact action

Merge pull request #293 from nonelement/fix-warning-text

fix warning text for bad sxHeight