Incorrect code in sft_kerning

[dkoreshkov]

When there is more than 1 subtable the loop will break because it adds to offset more than just the subtable length.
offset += 6;
offset += 8;
offset += length;
According to MS, the header contains "Length of the subtable, in bytes (including this header)"

Futhermore, there should be an is_safe_offset litany before bsearch.