forme 0.7.0

Colour glyphs painted, emoji fonts of every kind loaded and shaped, and
clusters as HarfBuzz forms them. Closes #884 and #886 to #889.

Painting (shape):

• Face.PaintGlyph paints a glyph through a Painter, HarfBuzz's
  hb_paint_funcs_t in Go: a COLRv1 paint graph or COLRv0 layers coloured
  from a CPAL palette, with PaletteOverrides; an SVG glyph's document; a
  CBDT or sbix PNG at the strike for PaintOptions.PPEM; or a glyph's
  outline in the foreground. Face.GlyphColour says which. A COLR glyph
  past its bounds is refused whole with ErrPaintLimit. Painting matches
  hb_font_paint_glyph call for call over the colour fixtures and Noto Color
  Emoji's COLRv1 and CBDT builds.

Loading:

• A font whose glyphs are only bitmaps (CBDT, sbix, EBDT, no outlines)
  loads; Face.BitmapOnly says so, and Subset refuses it.
• LoadCollection, LoadCollectionInstance and CollectionFaces read a face
  of a .ttc/.otc, its tables shared with the collection, and of a WOFF 2
  collection. WOFF 2 collections are checked against Google's encoder and
  decoder and against allsorts; a loca not directly after its glyf is now
  refused, as §5.5 requires.

AAT (shape):

• morx, and mort where there is no morx, as HarfBuzz and CoreText apply
  them: all five subtable kinds, features a document asks for mapped
  through feat, chains keyed to the run's language through ltag. Every
  case of the text-rendering tests' MORX suite matches HarfBuzz; Apple
  Color Emoji's sequences are one glyph each.
• kerx, all five formats, with ankr and contour points as FreeType numbers
  them for glyf and CFF; and trak, at the size the text is set at
  (Features.PointSize, Face.FeaturesAt), wired through layout.

Clusters:

• Glyph.Cluster now merges as HarfBuzz's default cluster level does: a
  grapheme is one cluster, and ligatures, deletions and reordering merge
  theirs. Every shaping oracle compares clusters. GroupAdvances now takes
  the group's text rather than its length.

Fixes found by fuzzing and review:

• Used no longer lists a glyph past the font's end; a morx run is capped
  at HarfBuzz's maximum length; the CFF written from a CFF2 font keeps
  only CFF's Private DICT operators and drops hints a reader would mis-size;
  a solid fill is charged for no colour stops, so flags of thousands of
  paints are painted.
• The fuzz targets minimize an input in 200 tries.

Also: Features.PointSize, segment.ExtendedPictographic, ImageSVG,
ColourSVG. Bounded shaping (ShapeGlyphsBounded) covers the AAT paths.

Known gaps: Myanmar cluster merging is untested for want of a font; no
independent WOFF 2 encoder writes collections; Source Serif 4 Variable cut
away from its default still draws up to about 4 units off HarfBuzz.

The whole suite with every corpus, and go test -race ./..., passed on CI
for each pull request in this release, and the CSS Working Group reftests
are at their baseline: 5,996 of 6,253 pass with nothing unsupported.

Pre-1.0. This adds exported API and changes GroupAdvances's signature and
what Glyph.Cluster holds.