[subset] Sanitize substitute feature parameters (#6413)

* [layout] Sanitize substitute feature params with their feature tag

FeatureTableSubstitutionRecord sanitized its substitute Feature with
no feature tag, so FeatureParams::sanitize() checked nothing for it.
The subsetter reads those params by the tag of the feature they
replace: Record::subset() when instancing applies the substitutes,
and FeatureTableSubstitutionRecord::subset(),
FeatureVariations::collect_name_ids() and
_features_have_equal_params() since #6349 and #6350.  A size, ssXX
or cvXX substitute could thus be read past the end of the table.

Pass the FeatureList down from GSUBGPOS::sanitize() and sanitize
each substitute with the tag of its featureIndex, the tag every
reader uses.

Test: test_feature_substitution_params_sanitize in test-serialize.

Assisted-by: Claude

* [subset] Drop feature params when built without them

With HB_NO_LAYOUT_FEATURE_PARAMS, FeatureParams::sanitize() checks
nothing and collect_name_ids() keeps none of their names, yet
FeatureParams::subset() still copied the params by their tag.
Return false there too, so the subsetter drops them, like the other
FeatureParams readers do in that configuration.

Assisted-by: Claude

---------

Co-authored-by: Mar <mardgez13@gmail.com>