Fix panics on malformed inputs, support fuzzing

[Shnatsel]

Bypass crc32 and adler32 checks when compiled with fuzzing instrumentation. This lets fuzzers reach actually interesting code.

Add a starting corpus for fuzzing, obtained initially by fuzzing other tools, then fed to afl-fuzz on image-png to get more inputs specific to it, and subsequently minified with afl-cmin.

Fix panics on malformed inputs discovered via fuzzing (#79):

• Panic on malformed paletted images in expand_paletted(): return Result instead of calling unwrap()
• Out of bounds access in unfilter(): now checks bounds and returns Result
• Panic in next_interlaced_row(): info from previous row was erroneously used to decode the current row. Fixing this no longer triggers a panic and likely fixes decoding of some real-world PNGs.
• Overflow on left shift described in #79 (comment)

Not fixed in this PR:

• Overflow in calculation of output buffer size (#80), which allows an attacker to exhaust system memory and/or the address space of the process. Fixing this would be a breaking change for the external API.
• Possibly some other overflows and debug mode panics that I cannot reach because of the above overflow happening before that code is reached

[bvssvni]

I think nwin removed as author here by accident.

[Shnatsel]

I have entirely replaced the afl/ subfolder without using anything that's in there previously. Its current incarnation is based only on https://github.com/rust-fuzz/targets, which is why Paul Grandperrin is credited.

I agree nwin should be credited for his contribution in some way, but I have removed him from the copyright notice for the source files the current afl/ folder is not based on his work in any way, and such misattribution is deliberately prohibited under some licenses, e.g. some BSD variants. This crate is dual-licensed under MIT and Apache, which do not have such a clause, so crediting nwin here would not be in conflict with the license.

I will re-add him as an author if you believe that is the best way to go about it.

[bvssvni]

Ah, it's under the "png-afl" directory, didn't saw that.

@nwin OK with this?

[Shnatsel]

Should I split the panic fixes to a separate PR so they would not be held up by a copyright notice?

[bvssvni]

I think it's OK. @nwin can just add himself back as author if he disagrees.

[bvssvni]

Merging.