[truetype] Fix handling of `cvar' table data. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=53 * src/truetype/ttgxvar.c (tt_face_vary_cvt): Ignore invalid CVT indices.