HarfBuzzShaper: Track normalization src and dst offsets separately

HarfBuzzShaper's normalizeCharacters() (etc) helpers walk over 16-bit
strings, copying and normalizing (replacing) some characters along the
way. The algorithm used the same position offset in both the source and
the destination buffers. In the uncommon case where a multi code unit
character is replaced by a single code unit character, garbage data
could be left in the destination buffer.

The fix is to track the source and destination offsets separately.

BUG=305476
R=eae@chromium.org

Review URL: https://codereview.chromium.org/26315011

git-svn-id: svn://svn.chromium.org/blink/trunk@159607 bbb929c8-8fbe-4397-9dbb-9b2b20218538