CVE-2025-27363: out of bounds write in FreeType <= 2.13.0

https://seclists.org/oss-sec/2025/q1/206

"This vulnerability may have been exploited in the wild."

"This commit fixes most of the issue - except `limit` is still signed short":

https://github.com/mozilla/gecko-dev/commit/026f6a947085020cd189dd9af3da00be433a44f8