[sfnt] Fix CPAL heap buffer overflow. Reported as https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=8968 * src/sfnt/ttcpal.c (tt_face_load_cpal): Guard CPAL version 1 offsets.