Audit for code that can lead to excessive runtime with malicious/malformed data

Specifically cases where we loop based on untrusted counts and/or iterate over ranges where the the sizes aren't bounded by data and thus caught during parsing.

For example, the [iterator for cmap format 12](https://github.com/googlefonts/fontations/blob/7c6115a66d143e9f885438fa7d5231ca87c15240/read-fonts/src/tables/cmap.rs#L221) can be forced to do 2^32 iterations _n_ times where cost is only `n * 12` bytes of malicious data.