[autofit] Prevent signed integer overflow.

Reported as

  https://issues.oss-fuzz.com/issues/473887994
  https://issues.oss-fuzz.com/issues/473912282

* src/autofit/afatin.c (af_latin_align_top_tilde,
  af_latin_align_bottom_tilde), src/autofit/afloader.c
  (af_loader_load_glyph): Use `FT_PIX_ROUND_LONG`, `FT_PIX_CEIL_LONG`, and
  `SUB_LONG`.