build: constify memchr()/strchr()/etc result variables

And a few variables around.

There remain cases where the accepted pointer is const, yet the returned
pointer is written to.

Partly addressing (glibc 2.43):
```
* For ISO C23, the functions bsearch, memchr, strchr, strpbrk, strrchr,
  strstr, wcschr, wcspbrk, wcsrchr, wcsstr and wmemchr that return
  pointers into their input arrays now have definitions as macros that
  return a pointer to a const-qualified type when the input argument is
  a pointer to a const-qualified type.
```
Ref: https://lists.gnu.org/archive/html/info-gnu/2026-01/msg00005.html

Reported-by: Rudi Heitbaum
Ref: #20420

Closes #20421

src/tool_cb_hdr.c

@@ -452,7 +452,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
     }
   }
   if(hdrcbdata->config->writeout) {
-    char *value = memchr(ptr, ':', cb);
+    const char *value = memchr(ptr, ':', cb);
     if(value) {
       if(per->was_last_header_empty)
         per->num_headers = 0;
@@ -466,7 +466,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
      (scheme == proto_http || scheme == proto_https ||
       scheme == proto_rtsp || scheme == proto_file)) {
     /* bold headers only for selected protocols */
-    char *value = NULL;
+    const char *value = NULL;
 
     if(!outs->stream && !tool_create_output_file(outs, per->config))
       return CURL_WRITEFUNC_ERROR;

src/tool_getparam.c

@@ -1673,7 +1673,7 @@ static ParameterError parse_upload_flags(struct OperationConfig *config,
     bool negate;
     const struct flagmap *map;
     size_t len;
-    char *next = strchr(flag, ','); /* Find next comma or end */
+    const char *next = strchr(flag, ','); /* Find next comma or end */
     if(next)
       len = next - flag;
     else

src/tool_operhlp.c

@@ -89,7 +89,7 @@ CURLcode add_file_name_to_url(CURL *curl, char **inurlp, const char *filename)
   char *path = NULL;
   char *query = NULL;
   if(uh) {
-    char *ptr;
+    const char *ptr;
     uerr = curl_url_set(uh, CURLUPART_URL, *inurlp,
                         CURLU_GUESS_SCHEME | CURLU_NON_SUPPORT_SCHEME);
     if(uerr) {

src/var.c

@@ -75,7 +75,7 @@ static const struct tool_var *varcontent(const char *name, size_t nlen)
 
 static ParameterError varfunc(char *c, /* content */
                               size_t clen, /* content length */
-                              char *f, /* functions */
+                              const char *f, /* functions */
                               size_t flen, /* function string length */
                               struct dynbuf *out)
 {
@@ -207,7 +207,7 @@ static ParameterError varfunc(char *c, /* content */
 ParameterError varexpand(const char *line, struct dynbuf *out, bool *replaced)
 {
   CURLcode result;
-  char *envp;
+  const char *envp;
   bool added = FALSE;
   const char *input = line;
   *replaced = FALSE;
@@ -232,8 +232,8 @@ ParameterError varexpand(const char *line, struct dynbuf *out, bool *replaced)
       char name[MAX_VAR_LEN];
       size_t nlen;
       size_t i;
-      char *funcp;
-      char *clp = strstr(envp, "}}");
+      const char *funcp;
+      const char *clp = strstr(envp, "}}");
       size_t prefix;
 
       if(!clp) {
@@ -304,7 +304,7 @@ ParameterError varexpand(const char *line, struct dynbuf *out, bool *replaced)
           if(value && vlen > 0) {
             /* A variable might contain null bytes. Such bytes cannot be shown
                using normal means, this is an error. */
-            char *nb = memchr(value, '\0', vlen);
+            const char *nb = memchr(value, '\0', vlen);
             if(nb) {
               errorf("variable contains null byte");
               return PARAM_EXPAND_ERROR;