Derive allocated pointer from _sb_heapcap.

Handle overly large allocations normally.

Avoid magic numbers.

Don't update _sb_heaplen, _sb_heapcap stores the length.
Add an almost but not quite working libpng_sb and test program.