[subset] Add missing face reference in hb-subset-plan plus ensure all struct members are cleaned up on destroy.

src/hb-subset-plan.cc

@@ -163,7 +163,7 @@ hb_subset_plan_create (hb_face_t           *face,
   plan->codepoints.init();
   plan->gids_to_retain.init();
   plan->gids_to_retain_sorted.init();
-  plan->source = face;
+  plan->source = hb_face_reference (face);
   plan->dest = hb_subset_face_create ();
 
   _populate_codepoints (input->unicodes, plan->codepoints);
@@ -189,5 +189,8 @@ hb_subset_plan_destroy (hb_subset_plan_t *plan)
   plan->gids_to_retain.finish ();
   plan->gids_to_retain_sorted.finish ();
 
+  hb_face_destroy (plan->source);
+  hb_face_destroy (plan->dest);
+
   free (plan);
 }