Make png_struct palette, trans_alpha private

This removes the side-effect on the png_struct palette of calling png_set_PLTE
or png_set_tRNS.  NOTE: this is a quiet API change, it was possible before to
alter the palette on a PNG image by using png_set_PLTE, but this was unintended
and inconsistent with the other png_set APIs.

Fix a bug in palette index checking; png_struct::num_palette could, in
principle, get changed by the transformations (e.g. png_set_quantize) and this
would invalidate the check.  The palette checking init function now makes a copy
of png_struct::num_palette.

Fix a bug in pngvalid error handling.  A png_error in png_write_info is not
continuable (a valid image cannot necessarily be written afterward) because the
png_error aborts the write of subsequent pre-IDAT chunks.  In particular an
abort as a result of a bogus colorspace information (gAMA, cHRM, sBIT etc)
prevents the write of the PLTE chunk.

Signed-off-by: John Bowler <jbowler@acm.org>

pngstruct.h

@@ -370,17 +370,18 @@ struct png_struct_def
     * the hope is that such processors will generate code that is both smaller
     * and faster.
     */
+#ifdef PNG_READ_SUPPORTED
    png_colorp  palette;        /* palette from the input file */
+#endif /* READ */
 #ifdef PNG_READ_tRNS_SUPPORTED
    png_bytep   trans_alpha;    /* alpha values for paletted files */
-#endif
+#endif /* READ_tRNS */
 
    png_uint_32 width;          /* width of image in pixels */
    png_uint_32 height;         /* height of image in pixels */
    png_uint_32 chunk_name;     /* PNG_CHUNK() id of current chunk */
    png_uint_32 chunk_length;   /* Length (possibly remaining) in said chunk. */
    png_uint_32 crc;            /* current chunk CRC value */
-   png_uint_32 free_me;        /* items libpng is responsible for freeing */
 
    unsigned int flags;                  /* flags (should be bit fields) */
    unsigned int mode                :6; /* where we are in the PNG file */