[autofit] Pin dynamic HarfBuzz symbol provider.

`RTLD_DEFAULT` is an ordered process-wide search scope, not a handle for one
library.  When Android's platform HarfBuzz precedes an application-provided
HarfBuzz:

* Common symbols such as hb_version_atleast resolve to the old platform
  copy.
* A symbol absent from that copy can resolve to the newer application copy.
* Resolving every function independently can therefore assemble a function
  table from incompatible HarfBuzz ABIs.

The existing code already avoids loading another HarfBuzz when one is
visible.  The problem is that it continues resolving functions against the
process-wide scope.

* src/autofit/ft-hb.c (ft_hb_funcs_init): Use `RTLD_DEFAULT` only to
  discover HarfBuzz, then resolve the complete API from a concrete provider.

  If the initial provider lacks a required symbol but `RTLD_DEFAULT` finds
  that symbol in another binary, treat the second binary as a new candidate
  and reassess the entire API against its concrete handle (using the
  temporarily defined macro `CHECK_PROVIDER`).  Accept it only if it
  supplies every required function; never retain a mixed table.

  The reassessment is bounded to one retry, preventing incomplete providers
  from cycling.

Fixes issue #1479.