build: constify memchr()/strchr()/etc result variables

And a few variables around.

There remain cases where the accepted pointer is const, yet the returned
pointer is written to.

Partly addressing (glibc 2.43):
```
* For ISO C23, the functions bsearch, memchr, strchr, strpbrk, strrchr,
  strstr, wcschr, wcspbrk, wcsrchr, wcsstr and wmemchr that return
  pointers into their input arrays now have definitions as macros that
  return a pointer to a const-qualified type when the input argument is
  a pointer to a const-qualified type.
```
Ref: https://lists.gnu.org/archive/html/info-gnu/2026-01/msg00005.html

Reported-by: Rudi Heitbaum
Ref: #20420

Closes #20421

lib/cookie.c

@@ -331,7 +331,7 @@ static bool bad_domain(const char *domain, size_t len)
     return FALSE;
   else {
     /* there must be a dot present, but that dot must not be a trailing dot */
-    char *dot = memchr(domain, '.', len);
+    const char *dot = memchr(domain, '.', len);
     if(dot) {
       size_t i = dot - domain;
       if((len - i) > 1)

lib/dict.c

@@ -136,7 +136,7 @@ static CURLcode sendf(struct Curl_easy *data, const char *fmt, ...)
 
 static CURLcode dict_do(struct Curl_easy *data, bool *done)
 {
-  char *word;
+  const char *word;
   char *eword = NULL;
   char *ppath;
   char *database = NULL;

lib/doh.c

@@ -129,7 +129,7 @@ UNITTEST DOHcode doh_req_encode(const char *host,
   /* encode each label and store it in the QNAME */
   while(*hostp) {
     size_t labellen;
-    char *dot = strchr(hostp, '.');
+    const char *dot = strchr(hostp, '.');
     if(dot)
       labellen = dot - hostp;
     else

lib/ftp.c

@@ -935,7 +935,7 @@ static CURLcode ftp_state_use_port(struct Curl_easy *data,
 
   if(data->set.str[STRING_FTPPORT] &&
      (strlen(data->set.str[STRING_FTPPORT]) > 1)) {
-    char *ip_end = NULL;
+    const char *ip_end = NULL;
 
 #ifdef USE_IPV6
     if(*string_ftpport == '[') {
@@ -1952,7 +1952,7 @@ static CURLcode ftp_state_pasv_resp(struct Curl_easy *data,
   if((ftpc->count1 == 0) &&
      (ftpcode == 229)) {
     /* positive EPSV response */
-    char *ptr = strchr(str, '(');
+    const char *ptr = strchr(str, '(');
     if(ptr) {
       char sep;
       ptr++;

lib/http.c

@@ -3829,7 +3829,7 @@ static CURLcode verify_header(struct Curl_easy *data,
                               const char *hd, size_t hdlen)
 {
   struct SingleRequest *k = &data->req;
-  char *ptr = memchr(hd, 0x00, hdlen);
+  const char *ptr = memchr(hd, 0x00, hdlen);
   if(ptr) {
     /* this is bad, bail out */
     failf(data, "Nul byte in header");
@@ -4369,7 +4369,7 @@ static CURLcode http_parse_headers(struct Curl_easy *data,
   struct connectdata *conn = data->conn;
   CURLcode result = CURLE_OK;
   struct SingleRequest *k = &data->req;
-  char *end_ptr;
+  const char *end_ptr;
   bool leftover_body = FALSE;
 
   /* we have bytes for the next header, make sure it is not a folded header

lib/http_aws_sigv4.c

@@ -333,8 +333,8 @@ static CURLcode merge_duplicate_headers(struct curl_slist *head)
 
     if(compare_header_names(curr->data, next->data) == 0) {
       struct dynbuf buf;
-      char *colon_next;
-      char *val_next;
+      const char *colon_next;
+      const char *val_next;
 
       curlx_dyn_init(&buf, CURL_MAX_HTTP_HEADER);
 
@@ -441,8 +441,9 @@ static CURLcode make_headers(struct Curl_easy *data,
      semi-colon, are not added to this list.
      */
   for(l = data->set.headers; l; l = l->next) {
-    char *dupdata, *ptr;
-    char *sep = strchr(l->data, ':');
+    char *dupdata;
+    const char *ptr;
+    const char *sep = strchr(l->data, ':');
     if(!sep)
       sep = strchr(l->data, ';');
     if(!sep || (*sep == ':' && !*(sep + 1)))
@@ -729,7 +730,7 @@ UNITTEST CURLcode canon_query(const char *query, struct dynbuf *dq)
   for(index = 0; index < num_query_components; index++) {
     const char *in_key;
     size_t in_key_len;
-    char *offset;
+    const char *offset;
     size_t query_part_len = curlx_dyn_len(&query_array[index]);
     char *query_part = curlx_dyn_ptr(&query_array[index]);
 

lib/netrc.c

@@ -122,7 +122,7 @@ static NETRCcode parsenetrc(struct store_netrc *store,
                               any order */
   bool our_login = FALSE;  /* found our login name */
   bool done = FALSE;
-  char *netrcbuffer;
+  const char *netrcbuffer;
   struct dynbuf token;
   struct dynbuf *filebuf = &store->filebuf;
   DEBUGASSERT(!*passwordp);
@@ -326,7 +326,7 @@ static NETRCcode parsenetrc(struct store_netrc *store,
       tok = ++tok_end;
     }
     if(!done) {
-      char *nl = NULL;
+      const char *nl = NULL;
       if(tok)
         nl = strchr(tok, '\n');
       if(!nl)

lib/pingpong.c

@@ -292,8 +292,8 @@ CURLcode Curl_pp_readresp(struct Curl_easy *data,
     }
 
     do {
-      char *line = curlx_dyn_ptr(&pp->recvbuf);
-      char *nl = memchr(line, '\n', curlx_dyn_len(&pp->recvbuf));
+      const char *line = curlx_dyn_ptr(&pp->recvbuf);
+      const char *nl = memchr(line, '\n', curlx_dyn_len(&pp->recvbuf));
       if(nl) {
         /* a newline is CRLF in pp-talk, so the CR is ignored as
            the line is not really terminated until the LF comes */

lib/pop3.c

@@ -809,8 +809,8 @@ static CURLcode pop3_state_servergreet_resp(struct Curl_easy *data,
   }
   else if(len > 3) {
     /* Does the server support APOP authentication? */
-    char *lt;
-    char *gt = NULL;
+    const char *lt;
+    const char *gt = NULL;
 
     /* Look for the APOP timestamp */
     lt = memchr(line, '<', len);
@@ -820,7 +820,7 @@ static CURLcode pop3_state_servergreet_resp(struct Curl_easy *data,
     if(gt) {
       /* the length of the timestamp, including the brackets */
       size_t timestamplen = gt - lt + 1;
-      char *at = memchr(lt, '@', timestamplen);
+      const char *at = memchr(lt, '@', timestamplen);
       /* If the timestamp does not contain '@' it is not (as required by
          RFC-1939) conformant to the RFC-822 message id syntax, and we
          therefore do not use APOP authentication. */

lib/telnet.c

@@ -115,8 +115,8 @@ struct TELNET {
   int himq[256];
   int him_preferred[256];
   int subnegotiation[256];
-  char *subopt_ttype;                /* Set with suboption TTYPE */
-  char *subopt_xdisploc;             /* Set with suboption XDISPLOC */
+  const char *subopt_ttype;          /* Set with suboption TTYPE */
+  const char *subopt_xdisploc;       /* Set with suboption XDISPLOC */
   unsigned short subopt_wsx;         /* Set with suboption NAWS */
   unsigned short subopt_wsy;         /* Set with suboption NAWS */
   TelnetReceive telrcv_state;
@@ -860,9 +860,9 @@ static CURLcode check_telnet_options(struct Curl_easy *data,
 
   for(head = data->set.telnet_options; head && !result; head = head->next) {
     size_t olen;
-    char *option = head->data;
-    char *arg;
-    char *sep = strchr(option, '=');
+    const char *option = head->data;
+    const char *arg;
+    const char *sep = strchr(option, '=');
     if(sep) {
       olen = sep - option;
       arg = ++sep;
@@ -1037,7 +1037,7 @@ static CURLcode suboption(struct Curl_easy *data, struct TELNET *tn)
         return CURLE_BAD_FUNCTION_ARGUMENT;
       /* Add the variable if it fits */
       if(len + tmplen < (int)sizeof(temp) - 6) {
-        char *s = strchr(v->data, ',');
+        const char *s = strchr(v->data, ',');
         if(!s)
           len += curl_msnprintf((char *)&temp[len], sizeof(temp) - len,
                                 "%c%s", CURL_NEW_ENV_VAR, v->data);

lib/url.c

@@ -2812,7 +2812,7 @@ static CURLcode parse_connect_to_string(struct Curl_easy *data,
     }
     else {
       /* check whether the URL's port matches */
-      char *ptr_next = strchr(ptr, ':');
+      const char *ptr_next = strchr(ptr, ':');
       if(ptr_next) {
         curl_off_t port_to_match;
         if(!curlx_str_number(&ptr, &port_to_match, 0xffff) &&

lib/urlapi.c

@@ -265,7 +265,7 @@ static CURLUcode parse_hostname_login(struct Curl_URL *u,
    *
    * We need somewhere to put the embedded details, so do that first.
    */
-  char *ptr;
+  const char *ptr;
 
   DEBUGASSERT(login);
 
@@ -577,7 +577,7 @@ static int ipv4_normalize(struct dynbuf *host)
 /* if necessary, replace the host content with a URL decoded version */
 static CURLUcode urldecode_host(struct dynbuf *host)
 {
-  char *per = NULL;
+  const char *per;
   const char *hostname = curlx_dyn_ptr(host);
   per = strchr(hostname, '%');
   if(!per)
@@ -780,8 +780,8 @@ UNITTEST int dedotdotify(const char *input, size_t clen, char **outp)
           /* remove the last segment from the output buffer */
           size_t len = curlx_dyn_len(&out);
           if(len) {
-            char *ptr = curlx_dyn_ptr(&out);
-            char *last = memrchr(ptr, '/', len);
+            const char *ptr = curlx_dyn_ptr(&out);
+            const char *last = memrchr(ptr, '/', len);
             if(last)
               /* trim the output at the slash */
               curlx_dyn_setlen(&out, last - ptr);

lib/vauth/vauth.c

@@ -117,7 +117,7 @@ bool Curl_auth_user_contains_domain(const char *user)
 
   if(user && *user) {
     /* Check we have a domain name or UPN present */
-    char *p = strpbrk(user, "\\/@");
+    const char *p = strpbrk(user, "\\/@");
 
     valid = (p != NULL && p > user && p < user + strlen(user) - 1);
   }

lib/vtls/vtls.c

@@ -689,7 +689,7 @@ CURLcode Curl_ssl_random(struct Curl_easy *data,
 static CURLcode pubkey_pem_to_der(const char *pem,
                                   unsigned char **der, size_t *der_len)
 {
-  char *begin_pos, *end_pos;
+  const char *begin_pos, *end_pos;
   size_t pem_count, pem_len;
   CURLcode result;
   struct dynbuf pbuf;