Hosting projects on Github: ban on storing font binaries

[m4rc1e]

This topic comes up every year in discussions so it is worthy of an issue. It can be added to https://googlefonts.github.io/gf-guide/hosting#commits-manage-progress-and-track-changes

Several of us believe we shouldn't be storing font binaries in the repo for the following reasons:

• The binaries may have been built from earlier commits or not the correct build chain
• They take up a lot of space
• They're not diffable.

Font binaries should be stored in tagged releases instead.

[davelab6]

@chrissimpkins wdyt

[rsheeter]

This seems consistent with the guiding principle to "treat fonts like software", provides a clear hook to build SBOMs, ... makes sense to me.

[vv-monsalve]

Duplicated, see #43

[chrissimpkins]

Agree with this. What needs to change in our tooling to support it?