Update libpng to 1.6.15.
Fix buffer overrrun with PNG screenshots.

When building up the row-pointer array we were off by one, so we would end up reading off the end of the buffer for the first row.

This was a bit hard to diagnose because of libpng's setjmp/longjmp shenanigans causing some bogosity in the callstack when this occured.