build: fix -Wunused-macros warnings, and related tidy-ups

- fix internal macro `AN_APPLE_OS` reused between sources without
  resetting it. It may potentially have left the system sha256
  function unused.
- fix to define `WOLFSSL_OPTIONS_IGNORE_SYS` so that it always applies
  to wolfSSL headers, also during feature detection.
- md4, md5, sha256: simplify fallback logic.
- delete 20+ unused macros.
- scope or move macros to avoid `-Wunused-macros` warnings.
- examples: delete unused code.

The warning detects macros defined but not used within the same C
source. It does not warn for macros defined in headers. It also works
with unity builds, but to a lesser extent.

Closes #20593

lib/vauth/ntlm.c

@@ -41,6 +41,9 @@
 #include "../curlx/strdup.h"
 #include "../curl_endian.h"
 
+/* "NTLMSSP" signature is always in ASCII regardless of the platform */
+#define NTLMSSP_SIGNATURE "\x4e\x54\x4c\x4d\x53\x53\x50"
+
 /* NTLM buffer fixed size, large enough for long user + host + domain */
 #define NTLM_BUFSIZE 1024
 
@@ -58,6 +61,7 @@
 /* Requests that the server's authentication realm be included in the Type 2
    message. */
 
+#if DEBUG_ME
 /* unknown (1 << 3) */
 #define NTLMFLAG_NEGOTIATE_SIGN                  (1 << 4)
 /* Specifies that authenticated communication between the client and server
@@ -73,10 +77,12 @@
 #define NTLMFLAG_NEGOTIATE_LM_KEY                (1 << 7)
 /* Indicates that the LAN Manager session key should be used for signing and
    sealing authenticated communications. */
+#endif
 
 #define NTLMFLAG_NEGOTIATE_NTLM_KEY              (1 << 9)
 /* Indicates that NTLM authentication is being used. */
 
+#if DEBUG_ME
 /* unknown (1 << 10) */
 
 #define NTLMFLAG_NEGOTIATE_ANONYMOUS             (1 << 11)
@@ -95,11 +101,13 @@
 /* Sent by the server to indicate that the server and client are on the same
    machine. Implies that the client may use a pre-established local security
    context rather than responding to the challenge. */
+#endif
 
 #define NTLMFLAG_NEGOTIATE_ALWAYS_SIGN           (1 << 15)
 /* Indicates that authenticated communication between the client and server
    should be signed with a "dummy" signature. */
 
+#if DEBUG_ME
 #define NTLMFLAG_TARGET_TYPE_DOMAIN              (1 << 16)
 /* Sent by the server in the Type 2 message to indicate that the target
    authentication realm is a domain. */
@@ -112,11 +120,13 @@
 /* Sent by the server in the Type 2 message to indicate that the target
    authentication realm is a share. Presumably, this is for share-level
    authentication. Usage is unclear. */
+#endif
 
 #define NTLMFLAG_NEGOTIATE_NTLM2_KEY             (1 << 19)
 /* Indicates that the NTLM2 signing and sealing scheme should be used for
    protecting authenticated communications. */
 
+#if DEBUG_ME
 #define NTLMFLAG_REQUEST_INIT_RESPONSE           (1 << 20)
 /* unknown purpose */
 
@@ -125,11 +135,13 @@
 
 #define NTLMFLAG_REQUEST_NONNT_SESSION_KEY       (1 << 22)
 /* unknown purpose */
+#endif
 
 #define NTLMFLAG_NEGOTIATE_TARGET_INFO           (1 << 23)
 /* Sent by the server in the Type 2 message to indicate that it is including a
    Target Information block in the message. */
 
+#if DEBUG_ME
 /* unknown (1<24) */
 /* unknown (1<25) */
 /* unknown (1<26) */
@@ -146,10 +158,6 @@
 #define NTLMFLAG_NEGOTIATE_56                    (1 << 31)
 /* Indicates that 56-bit encryption is supported. */
 
-/* "NTLMSSP" signature is always in ASCII regardless of the platform */
-#define NTLMSSP_SIGNATURE "\x4e\x54\x4c\x4d\x53\x53\x50"
-
-#if DEBUG_ME
 #define DEBUG_OUT(x) x
 static void ntlm_print_flags(FILE *handle, unsigned long flags)
 {