Reset localpoints when varying cvt.
When iterating over the cvt tuples and reading in the points it is necessary to set all of localpoints, points, and point_count in all cases. The existing code did not reset localpoints to NULL when there were no private point numbers. If the previous tuple did have private point numbers and set localpoints to ALL_POINTS this would not be cleared and the wrong branch would be taken later, leading to possible heap buffer overflow.
- src/truetype/ttgxvar.c (tt_face_vary_cvt): reset localpoints to NULL when it isn't valid.
Fixes: https://crbug.com/1284742