font whitelist fails to stop local fonts in @font-face
In #13313 (moved), we introduced a font whitelist pref. John Daggett pointed out in https://bugzilla.mozilla.org/show_bug.cgi?id=1121643#c6 that a CSS rule like:
@font-face {
font-family: "MyTimes";
src: local("Times");
}
allows content to use "Times" even if it is not in our whitelist.