Merge pull request #1456 from harfbuzz/cff-subr-sanitize

[CFF] fix oss-fuzz issue 11691 (BlendArg::set_blends)