Update ots to v9.1.0 and vendor dependencies

[jschwe]

Update ots to the latest release and vendor ots and all dependencies.

Motivation for vendoring: Cargo build will recursively clone submodules for git dependencies. ots itself and some of its dependencies have quite large git repos, e.g. ots has 80MB of test font files. Vendoring the sources reduces the required network bandwidth and disk space usage greatly. See also rust-lang/cargo#7987 for more details on the effects on disk usage (not super relevant for us, since we rarely update our dependencies).

To update the vendored dependencies (or double-check the check-in contents match upstream) you can run the script src/deps/update_deps.sh

Ideally, each of the C dependencies would have their own crate, but that can be done later.

[jschwe]

@mrobinson The diff might look huge, but the actual changes are quite limited:

• Update src/ots_glue.cc to match ots v9.1.0
• Move from using git submodules to vendoring source files (recommended approach by ots), since it greatly reduces the size needed to clone (stable cargo currently does not support even shallow cloning)
• Add a simple bash file src/deps/update_deps.sh, which can update the vendored dependencies. It should be easy to review.
• Minor adjustments to the CMake to improve the maintainability.
• Update the readme to also list the licenses of our dependencies, since they will be statically linked into fontsan.

[mrobinson]

This is a really nice change. I especially love the clear documentation.

The only thing I noticed is perhaps we can remove submodules: recursive from the GitHub Actions file at

fontsan/.github/workflows/test.yml

Line 18 in 0e9bc74

submodules: recursive

.

[jschwe]

The only thing I noticed is perhaps we can remove submodules: recursive from the GitHub Actions file at

Good point! Removed.