Freetype 2.5.3; please comment

This fixes CVE-2014-2240.  But I'm not sure I understand the implications completely.  Could @vcunat or maybe someone who commented on #2020 comment?

I removed the Infinality patch, because it looks like it hasn't been updated for 2.5.x, and I read that some of the functionality has been merged into freetype.  But I'm not sure if that means they're included in 2.5.3.

Also worrysome: I enabled ```-DTT_CONFIG_OPTION_SUBPIXEL_HINTING=1``` unconditionally, since it doesn't depend on Infinality any more.  But why isn't it enabled by default?  Does that use patent-encumbered stuff if the Infinality patch isn't applied?

I submitted the pull request mostly because of the CVE :-)  Tested with Firefox; I'll soon test with everything else.