Fixes CVE-2023-43907.
Changelog:
```
* Upgraded libpng to version 1.6.40.
* Upgraded zlib to version 1.3-optipng.
* Upgraded cexcept to version 2.0.2-optipng.
!! Fixed a global-buffer-overflow vulnerability in the GIF reader.
[Reported by Zeng Yunxiang; fixed by Thomas Hurst]
! Fixed a stack-print-after-scope defect in the error handler.
! Fixed an assertion failure in the image reduction module.
! Fixed the command-line wildargs expansion in the Windows port.
* Raised the minimum required libpng version from 1.2.9 to 1.6.35.
* Raised the minimum required zlib version from 1.2.1 to 1.2.8.
* Refactored the structured exception handling.
```
https://optipng.sourceforge.net/history.txt
We can use use `stdenv.hostPlatform.isStatic` instead, and move the
logic per package. The least opionated benefit of this is that it makes
it much easier to replace packages with modified ones, as there is no
longer any issue of overlay order.
CC @FRidh @matthewbauer
