Tidy up testdata

@drott [suggested](https://github.com/googlefonts/fontations/pull/1099#discussion_r1723408894):

> Similar to practices in Chromium or our other open source projects, I would suggest to create a `test_data/third_party/` or `test_data/third_party/harfbuzz` directory, and please a readme with provenance and license there, so we have a clear indication where the font is coming from.

The original comment was for one specific test file but I think it applies to all our test data.

Start by locating the repository's existing test data and the specific test file referenced in the linked discussion. Review how test data is currently organized, then assess moving it under test_data/third_party/harfbuzz and adding a README documenting the font's provenance and license. Done means all test data follows the agreed organization and its source information is recorded.

Written by the indexing model from the issue text.