Fix JNI abort due to mismatched critical get/release call.

ReleasePrimitiveArrayCritical need to be called after
GetPrimitiveArrayCritical. However doRunAdvance or doOffsetForAdvance
may call JNI::DeleteGlobalRef if the SkTypeface is gone due to cache
overflow. Thus, use GetArrayElements/ReleaseArrayElements with
ScopedCharArrayRO.

Bug: 70660389
Test: Test app attached to the bug.
Change-Id: Ied8e74588783f11b437c3f2c6ea726a9c6d2fc9e