clang-tidy: enable clang-analyzer-* checks explicitly, fix fallout

v22.1.0 disabled them by default.

Fix fallout:
- http: check NULL to silence false positives in `HD_VAL()`.

Ref: https://releases.llvm.org/22.1.0/tools/clang/tools/extra/docs/ReleaseNotes.html#improvements-to-clang-tidy

Follow-up to da6fbb12a6 #20779
Follow-up to ce4db9c2ef #20751

Closes #20778

.clang-tidy.yml

@@ -6,6 +6,7 @@
 
 # https://clang.llvm.org/extra/clang-tidy/checks/list.html
 Checks:
+  - clang-analyzer-*
   - -clang-analyzer-optin.performance.Padding
   - -clang-analyzer-security.ArrayBound  # due to false positives with clang-tidy v21.1.0
   - -clang-analyzer-security.insecureAPI.bzero  # for FD_ZERO() (seen on macOS)

lib/http.c

@@ -3185,7 +3185,7 @@ static statusline checkprotoprefix(struct Curl_easy *data,
   (((hdlen) >= (sizeof(n) - 1)) && curl_strnequal(n, hd, sizeof(n) - 1))
 
 #define HD_VAL(hd, hdlen, n) \
-  ((((hdlen) >= (sizeof(n) - 1)) && \
+  ((((hdlen) >= (sizeof(n) - 1)) && (hd) && \
     curl_strnequal(n, hd, sizeof(n) - 1)) ? ((hd) + (sizeof(n) - 1)) : NULL)
 
 /* HTTP header has field name `n` (a string constant) and contains `v`