Everything is now using the latests upstream release, except libass and
harfbuzz whose bump is postponed to the next commit.
- the libass-submodule uses current master, since we know its safe
- FreeType remote changed to match upstreams new primary server
- FreeType incorporated BSL-1 licensed code from dlg;
this also requires a recursive submodule init in our CI now
- FreeType now also detects and utilises pthread when available,
which we need to surpress