[type42] Fix heap buffer overflow (#46269). * src/type42/t42parse.c (t42_parse_sfnts): Fix off-by-one error in bounds checking.