figure out API/alloc situation for avar2

[cmyr]

We currently only support avar2 for tons of up to 64 axes, because otherwise we need to allocate and we haven't decided yet who is going to be responsible for that.

Yes, avar2 fundamentally requires allocation. Though I think we can cover 100% of real world fonts by attempting allocation on the stack first. An array of size 64 is probably of reasonable size. If you’d prefer not to add that here, I’ll do it as a follow up.

Originally posted by @dfrg in #1120 (comment)