Fix circular composite glyph path resolution

[fdb]

Summary

• detect re-entrant TrueType glyph path loading and throw a controlled error for circular composite references
• add regression coverage for cyclic composite glyphs in normal and lowMemory parsing modes
• include a minimal malicious TrueType fixture and generator script to reproduce the issue deterministically

Testing

• npm test

[fdb]

Closing as this is superseded by #826 which was merged with a similar fix (cycle detection in glyf.mjs using a per-GlyphSet WeakMap). Thanks for the original work on this — it informed the final approach.