Replace invalid codepoints with U+FFFD (REPLACEMENT CHARACTER)

This is what Unicode suggests to do.
In contrast to raising an error (which only useful when there is
someone to catch that error), this allows to skip the codepoint
validity checks in the hb_unicode callbacks.