Guard CFF2 BLEND operator against empty argument stack

[scadastrangelove]

Closes #218.

operator::BLEND => {
    ctx.had_blend = true;

    if p.stack.is_empty() {
        return Err(CFFError::InvalidArgumentsStackLength);
    }

    let n = u16::try_num_from(p.stack.pop())
        ...

Mirrors the existing VS_INDEX guard immediately above it (if p.stack.len() != 1 { return Err(...) }) and reuses the existing CFFError::InvalidArgumentsStackLength variant — no new
error type needed.

Testing

• Full suite green: cargo test --all-features --release — 148/149 (the one failure,
  font_collection_num_fonts_overflow_2, is pre-existing and reproduces identically on
  unmodified main, unrelated to this change).
• Verified the attached reproducer panics on unpatched main and returns a clean None with
  this patch.

---

Discovered by the rust-in-peace security pipeline.