Pass codepoints to GlyphData.xml queries for DS/UFO sources

In the [#2021](https://github.com/googlefonts/fontc/pull/2021) PR, when inferring preliminary GDEF categories from GlyphData.xml for DS/UFO sources without explicit `public.openTypeCategories` (when `propagateAnchors` filter is requested), `GlyphData::query()` is called with `None` for the codepoints argument. This means glyphs with non-standard names that aren't in GlyphData.xml by name can only be resolved via the `construct_result` suffix-stripping fallback, not via codepoint lookup.

fontmake's equivalent code [passes unicodes](https://github.com/googlefonts/fontmake/blob/88e053fe1837/Lib/fontmake/font_project.py#L157-L158) to `glyphdata.get_glyph()`:

```python
glyphinfo = glyphdata.get_glyph(
glyph.name, unicodes=[f"{c:04X}" for c in glyph.unicodes]
)
```

Glyph names are less standardized in UFOs compared to .glyphs sources, making codepoint-based resolution more important there.

The difficulty is that `preliminary_gdef_categories_from_glyphdata` runs during `StaticMetadataWork`, before glif files are parsed (glyph IR work happens later). Codepoints live inside the glif XML `` elements.

Possible approaches:

- Add a lightweight API to norad to scan a layer's glif files for just the `` elements without full glyph parsing. The element is always near the top of the file, so a shallow XML scan would be cheap.
- Load the default layer fully via norad during `StaticMetadataWork` -- correct but wasteful since it parses outlines too.
- Custom quick-xml scan of glif files in fontc.

A norad API seems cleanest since it benefits any consumer that needs a name-to-codepoint map without full glyph parsing.

(Related to #145: if codepoints lived in a global `CharacterMap` in static metadata rather than per-glyph, they'd be available at this stage... just saying).

Start at preliminary_gdef_categories_from_glyphdata during StaticMetadataWork and trace how GlyphData::query() receives its codepoints for DS/UFO sources. Review the mentioned norad and glif XML handling options, then verify that non-standard glyph names can resolve through their elements before glyph IR parsing.

Written by the indexing model from the issue text.