Make png_struct palette, trans_alpha private

This removes the side-effect on the png_struct palette of calling png_set_PLTE
or png_set_tRNS.  NOTE: this is a quiet API change, it was possible before to
alter the palette on a PNG image by using png_set_PLTE, but this was unintended
and inconsistent with the other png_set APIs.

Fix a bug in palette index checking; png_struct::num_palette could, in
principle, get changed by the transformations (e.g. png_set_quantize) and this
would invalidate the check.  The palette checking init function now makes a copy
of png_struct::num_palette.

Fix a bug in pngvalid error handling.  A png_error in png_write_info is not
continuable (a valid image cannot necessarily be written afterward) because the
png_error aborts the write of subsequent pre-IDAT chunks.  In particular an
abort as a result of a bogus colorspace information (gAMA, cHRM, sBIT etc)
prevents the write of the PLTE chunk.

Signed-off-by: John Bowler <jbowler@acm.org>

pngwutil.c

@@ -1319,14 +1319,6 @@ png_write_tRNS(png_structrp png_ptr, png_const_bytep trans_alpha,
    if (color_type == PNG_COLOR_TYPE_PALETTE)
    {
       affirm(num_trans > 0 && num_trans <= PNG_MAX_PALETTE_LENGTH);
-      if ((unsigned int)/*SAFE*/num_trans > png_ptr->num_palette)
-      {
-         /* This is an error which can only be reliably detected late. */
-         png_app_error(png_ptr,
-             "Invalid number of transparent colors specified");
-         return;
-      }
-
       {
 #        ifdef PNG_WRITE_INVERT_ALPHA_SUPPORTED
             union