cmake: fix system include directory position for clang-tidy in tests

To avoid a system include masking a custom directory, and e.g. picking
up system OpenSSL headers from `/usr/include` on Linux, instead of the
correct ones from a custom header directory, move system include
directories to the back of the header path list. Also to match what
CMake seems to be doing for the C compiler command-lines it generates.

CMake seems to use `-I`, while for these invocations we stick with
`-isystem` just in case.

This area remains fragile and likely not the final issue.

Fixing (seen in GHA/linux H3 c-ares):
```
Error while processing bld/tests/libtest/lib1521.c.
/usr/include/openssl/macros.h:147:4: error: "OPENSSL_API_COMPAT expresses an impossible API compatibility level" [clang-diagnostic-error]
Found compiler error(s).
  147 | #  error "OPENSSL_API_COMPAT expresses an impossible API compatibility level"
      |    ^
FAILED: [code=1] tests/libtest/CMakeFiles/libtests-clang-tidy
```
Ref: https://github.com/curl/curl/actions/runs/22468472670/job/65079885471?pr=20751

Bug: https://github.com/curl/curl/pull/20751#issuecomment-3970180687
Cherry-picked from #20751

Closes #20759

scripts/cmakelint.sh

@@ -72,8 +72,8 @@ cd "$(dirname "$0")"/..
     --min-statement-spacing 1 \
     --max-statement-spacing 2 \
     --max-returns 6 \
-    --max-branches 12 \
+    --max-branches 15 \
     --max-arguments 5 \
     --max-localvars 15 \
-    --max-statements 65 \
+    --max-statements 85 \
     --