update nss patch from upstream
fix linking with harfbuzz-0.9.18; upstream patch