fix: Handle getter-to-setter aliasing in append-style chunk setters

Apply the same class of robustness fix from the previous commit to
`png_set_text`, `png_set_sPLT` and `png_set_unknown_chunks`. These
append-style setters used `png_realloc_array` to grow the internal
array, then freed the old array before copying from the caller's
input. If the caller's pointer was obtained from the corresponding
getter, it aliased the freed array.

The fix defers the freeing of the old array until after the copy loop.

Also extend the pnggetset regression test to cover all three setters.