Fix heap buffer overflow from short truncation of span Y coordinate

SW_FT_Span.y is a 16-bit short, so limit our coordinates appropriately.
The clamp (and its "is an integer" comment) was inherited from upstream
FreeType's ftgrays.c, where FT_Span has no y field and the
scanline y is carried separately as an int. rlottie added a `short y` to
the span struct without adapting the clamp, so the INT_MAX bound never
prevented the (short) narrowing at the store site.