Merge pull request #1457 from harfbuzz/cff-varstore-sanitize

[CFF] oss-fuzz issue 11713 (CFF2VariationStore::serialize)