Evaluate whether 5.9.7 needs a harfbuzz update

src/3rdparty/harfbuzz-ng/qt_attribution.json

• Has a 1.9.0 release (2018, September); our 5.9 is on its 1.4.1; dev has 1.7.4
• ritt.ks did the 1.4.1 update, esabraha reviewed
• laknoll did the 1.7.4 update

src/3rdparty/harfbuzz/qt_attribution.json

• appears to be superseded by harfbuzz-ng; why do we still have the old version ?

5.9.7 is in strict mode, so only if security or critical issues in 1.4.1 are known to be fixed in later versions. An update on some later branch might make sense for less urgent reasons.