forme 0.4.3

Two fixes to the shape package, both from issues filed against 0.4.2: a
bold face with no OS/2 table now states its weight, and a font whose
feature list asks for far more lookups than it holds no longer takes
seconds in shape.Load.

A face with no weight class takes its weight from its bold bit (#873, #871)

Without OS/2, Descriptor.Weight was 0 and undeclared, even though
head.macStyle bit 0 marks the face bold. The italic bit next to it was
already read.

• The weight now comes from the bold bit of whichever field the style is
  read from: fsSelection bit 5 when OS/2 reaches offset 64, otherwise
  macStyle bit 0. Bold gives 700, anything else 400, and the weight is
  marked declared.
• It applies only where OS/2 does not state usWeightClass. usWeightClass
  still wins wherever it is present.
• With OS/2 removed, Liberation Sans Bold and BoldItalic now read 700 and
  Regular 400, all declared. With OS/2 in place, nothing changes.
• Layout is unaffected: font matching reads @font-face weights, not
  Descriptor.Weight.

A feature list is read within its table's size (#874, #872)

A spliced font's GPOS FeatureList had 12,663 records under 4,334 tags,
pointing at about 5,100 overlapping lists. Reading it meant reading 165
million lookup indices to keep 8.4 million. Every list lay within the
table, so the 65,535-per-list cap refused none of them, and n records on
one list of n cost n².

• What a table's features may name between them is now bounded by the
  table's size: half its length in indices, plus one maximal list (65,535).
• Past that allowance, the features already covered are kept whole and in
  order, and the rest name nothing. Face.LayoutLimits reports it, as it
  does for the other bounds.
• Real fonts are well below the bound: across 159 fonts and 231 GSUB and
  GPOS tables, the most any table asks is 0.07 indices per byte.
• On the font from the issue, shape.Load drops from 2.8 s to 12 ms.
  Over 1,600 mutated copies of Liberation Sans Regular, the worst case
  goes from 4.1 s to 22 ms. The intact font is unchanged at 0.4 ms.

CI no longer fetches the W3C licence page (#875, #876)

THIRD_PARTY_NOTICES quotes the W3C Software and Document License from a
copy now kept in testdata/w3c-licence/. The page has no versioned URL,
and it changed twice in two days with W3C's site while the licence on it
stayed the same, failing every CI job. Nothing in the library changes.

Where it stands

Unchanged from 0.4.2, as measured on each of the two fixes:

5,996 of the CSS Working Group's 6,253 reftests pass with nothing
unsupported reported in either document; 66 pass with something
unsupported, and 191 fail

The whole suite with every corpus, and go test -race ./..., passed on CI
for each pull request in this release.

Pre-1.0. This adds no exported API and removes none.