[truetype] Update a frame length check.

Both 'region_count' and 'axis_count' are read as USHORT with the
former further capped at 32767. Their product will never overflow.
It is the multiplication by 6 that does it.

* src/truetype/ttgxvar.c (tt_var_load_item_variation_store): Update.