FreeType Cache abuses

Hi all

We've recently received two reports with potential security
implications when FreeType Cache is abused in very specific and
unusual ways.

https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1401
https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1418

In both cases, first the lookup functions are called to obtain the
FTC_Node reference pointer as the last argument. Then the cache is
forced to abandon and free the node leaving the dangling pointer. At
last, the user triggers use-after-free.

We can certainly provide some protections against these abuses but is
it really worth it? Is it really FreeType's fault or the user's who
actually triggers use-after-free at last?

Werner will shortly lift the confidential flag. We would appreciate
your feedback and assessment from the local security experts.

Thank you
Alexei