Panic in CFF parsing and `Entry::PrivateDictRange`

From
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69991
https://oss-fuzz.com/testcase-detail/5933171414204416

```
#11 0x56f83d6a91c2 in core::panicking::panic::h93f2974d1a0ad31d /rustc/1a648b397dedc98ada3dd3360f6d661ec2436c56/library/core/src/panicking.rs:144:5
#12 0x56f83dcb44a0 in read_fonts::tables::postscript::dict::parse_entry::hb389cc76a0b045d3 [fontations/read-fonts/src/tables/postscript/dict.rs:337](https://github.com/googlefonts/fontations/blob/e3a8f376d8e7c7c26e22ecc0cd3aea79261e5517/read-fonts/src/tables/postscript/dict.rs#L337):44
#13 0x56f83d83644b in read_fonts::tables::postscript::dict::entries::_$u7b$$u7b$closure$u7d$$u7d$::hae4e7ccb09d4f1b9 [fontations/read-fonts/src/tables/postscript/dict.rs:311](https://github.com/googlefonts/fontations/blob/e3a8f376d8e7c7c26e22ecc0cd3aea79261e5517/read-fonts/src/tables/postscript/dict.rs#L311):29
#14 0x56f83d8ea684 in _$LT$core..iter..sources..from_fn..FromFn$LT$F$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$::next::h9c586c445534e9e8 /rustc/1a648b397dedc98ada3dd3360f6d661ec2436c56/library/core/src/iter/sources/from_fn.rs:69:9
#15 0x56f83d8ea684 in skrifa::outline::cff::TopDict::new::h27db21f149f61fc8 [fontations/skrifa/src/outline/cff/mod.rs:349](https://github.com/googlefonts/fontations/blob/e3a8f376d8e7c7c26e22ecc0cd3aea79261e5517/skrifa/src/outline/cff/mod.rs#L349):22
```

`Entry::PrivateDictRange(start..start + len)` leads to a panic probably because both values are taken verbatim from the font file and produce and out of range access.

Start with the OSS-Fuzz testcase and the panic in fontations/read-fonts/src/tables/postscript/dict.rs at lines 311 and 337. Then inspect skrifa/src/outline/cff/mod.rs around line 349 to trace how Entry::PrivateDictRange is consumed. Done means the testcase no longer causes a panic and out-of-range values are handled safely.

Written by the indexing model from the issue text.