build: enable -Wcast-qual, fix or silence compiler warnings

The issues found fell into these categories, with the applied fixes:

- const was accidentally stripped.
  Adjust code to not cast or cast with const.

- const/volatile missing from arguments, local variables.
  Constify arguments or variables, adjust/delete casts. Small code
  changes in a few places.

- const must be stripped because an API dependency requires it.
  Strip `const` with `CURL_UNCONST()` macro to silence the warning out
  of our control. These happen at API boundaries. Sometimes they depend
  on dependency version, which this patch handles as necessary. Also
  enable const support for the zlib API, using `ZLIB_CONST`. Supported
  by zlib 1.2.5.2 and newer.

- const must be stripped because a curl API requires it.
  Strip `const` with `CURL_UNCONST()` macro to silence the warning out
  of our immediate control. For example we promise to send a non-const
  argument to a callback, though the data is const internally.

- other cases where we may avoid const stripping by code changes.
  Also silenced with `CURL_UNCONST()`.

- there are 3 places where `CURL_UNCONST()` is cast again to const.
  To silence this type of warning:
  ```
  lib/vquic/curl_osslq.c:1015:29: error: to be safe all intermediate
    pointers in cast from 'unsigned char **' to 'const unsigned char **'
    must be 'const' qualified [-Werror=cast-qual]
  lib/cf-socket.c:734:32: error: to be safe all intermediate pointers in
    cast from 'char **' to 'const char **' must be 'const' qualified
    [-Werror=cast-qual]
  ```
  There may be a better solution, but I couldn't find it.

These cases are handled in separate subcommits, but without further
markup.

If you see a `-Wcast-qual` warning in curl, we appreciate your report
about it.

Closes #16142

src/mkhelp.pl

@@ -122,8 +122,8 @@ void hugehelp(void)
   memset(&z, 0, sizeof(z_stream));
   z.zalloc = (alloc_func)zalloc_func;
   z.zfree = (free_func)zfree_func;
-  z.avail_in = (unsigned int)(sizeof(hugehelpgz) - HEADERLEN);
-  z.next_in = (unsigned char *)hugehelpgz + HEADERLEN;
+  z.avail_in = (uInt)(sizeof(hugehelpgz) - HEADERLEN);
+  z.next_in = (z_const Bytef *)hugehelpgz + HEADERLEN;
 
   if(inflateInit2(&z, -MAX_WBITS) != Z_OK)
     return;
@@ -162,8 +162,8 @@ void showhelp(const char *trigger, const char *arg, const char *endarg)
   memset(&z, 0, sizeof(z_stream));
   z.zalloc = (alloc_func)zalloc_func;
   z.zfree = (free_func)zfree_func;
-  z.avail_in = (unsigned int)(sizeof(hugehelpgz) - HEADERLEN);
-  z.next_in = (unsigned char *)hugehelpgz + HEADERLEN;
+  z.avail_in = (uInt)(sizeof(hugehelpgz) - HEADERLEN);
+  z.next_in = (z_const Bytef *)hugehelpgz + HEADERLEN;
 
   if(inflateInit2(&z, -MAX_WBITS) != Z_OK)
     return;
@@ -235,8 +235,8 @@ void showhelp(const char *trigger, const char *arg, const char *endarg)
   inithelpscan(&ctx, trigger, arg, endarg);
   while(curlman[i]) {
     size_t len = strlen(curlman[i]);
-    if(!helpscan((unsigned char *)curlman[i], len, &ctx) ||
-       !helpscan((unsigned char *)"\\n", 1, &ctx))
+    if(!helpscan((const unsigned char *)curlman[i], len, &ctx) ||
+       !helpscan((const unsigned char *)"\\n", 1, &ctx))
       break;
     i++;
   }

src/tool_cb_hdr.c

@@ -250,7 +250,7 @@ size_t tool_header_cb(char *ptr, size_t size, size_t nmemb, void *userdata)
          hdrcbdata->config->show_headers) {
         /* still awaiting the Content-Disposition header, store the header in
            memory. Since it is not zero terminated, we need an extra dance. */
-        char *clone = aprintf("%.*s", (int)cb, (char *)str);
+        char *clone = aprintf("%.*s", (int)cb, str);
         if(clone) {
           struct curl_slist *old = hdrcbdata->headlist;
           hdrcbdata->headlist = curl_slist_append(old, clone);

src/tool_filetime.c

@@ -43,7 +43,7 @@ int getfiletime(const char *filename, struct GlobalConfig *global,
    access to a 64-bit type we can bypass stat and get the times directly. */
 #if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
   HANDLE hfile;
-  TCHAR *tchar_filename = curlx_convert_UTF8_to_tchar((char *)filename);
+  TCHAR *tchar_filename = curlx_convert_UTF8_to_tchar(filename);
 
   hfile = CreateFile(tchar_filename, FILE_READ_ATTRIBUTES,
                       (FILE_SHARE_READ | FILE_SHARE_WRITE |
@@ -97,7 +97,7 @@ void setfiletime(curl_off_t filetime, const char *filename,
    access to a 64-bit type we can bypass utime and set the times directly. */
 #if defined(_WIN32) && !defined(CURL_WINDOWS_UWP)
     HANDLE hfile;
-    TCHAR *tchar_filename = curlx_convert_UTF8_to_tchar((char *)filename);
+    TCHAR *tchar_filename = curlx_convert_UTF8_to_tchar(filename);
 
     /* 910670515199 is the maximum Unix filetime that can be used as a
        Windows FILETIME without overflow: 30827-12-31T23:59:59. */

src/tool_getparam.c

@@ -1789,7 +1789,7 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
     if(ARGTYPE(a->desc) >= ARG_STRG) {
       /* this option requires an extra parameter */
       if(!longopt && parse[1]) {
-        nextarg = (char *)&parse[1]; /* this is the actual extra parameter */
+        nextarg = &parse[1]; /* this is the actual extra parameter */
         singleopt = TRUE;   /* do not loop anymore after this */
 #ifdef HAVE_WRITABLE_ARGV
         clearthis = &cleararg1[parse + 2 - flag];
@@ -1832,7 +1832,7 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
          that use nextarg should be marked as such and they will check that
          nextarg is set before continuing, but code analyzers are not always
          that aware of that state */
-      nextarg = (char *)"";
+      nextarg = "";
 
     switch(cmd) {
     case C_RANDOM_FILE: /* --random-file */
@@ -2985,7 +2985,7 @@ ParameterError getparameter(const char *flag, /* f or -long-flag */
 
 error:
   if(nextalloc)
-    free((char *)nextarg);
+    free(CURL_UNCONST(nextarg));
   return err;
 }
 

src/tool_help.c

@@ -173,7 +173,7 @@ void inithelpscan(struct scan_ctx *ctx,
   memset(ctx->rbuf, 0, sizeof(ctx->rbuf));
 }
 
-bool helpscan(unsigned char *buf, size_t len, struct scan_ctx *ctx)
+bool helpscan(const unsigned char *buf, size_t len, struct scan_ctx *ctx)
 {
   size_t i;
   for(i = 0; i < len; i++) {

src/tool_help.h

@@ -45,7 +45,7 @@ struct scan_ctx {
 };
 void inithelpscan(struct scan_ctx *ctx, const char *trigger,
                   const char *arg, const char *endarg);
-bool helpscan(unsigned char *buf, size_t len, struct scan_ctx *ctx);
+bool helpscan(const unsigned char *buf, size_t len, struct scan_ctx *ctx);
 
 struct helptxt {
   const char *opt;

src/tool_operate.c

@@ -1214,7 +1214,7 @@ static CURLcode config2setopts(struct GlobalConfig *global,
 #ifdef CURL_CA_EMBED
   if(!config->cacert && !config->capath) {
     struct curl_blob blob;
-    blob.data = (void *)curl_ca_embed;
+    blob.data = CURL_UNCONST(curl_ca_embed);
     blob.len = strlen((const char *)curl_ca_embed);
     blob.flags = CURL_BLOB_NOCOPY;
     notef(config->global,
@@ -1228,7 +1228,7 @@ static CURLcode config2setopts(struct GlobalConfig *global,
   }
   if(!config->proxy_cacert && !config->proxy_capath) {
     struct curl_blob blob;
-    blob.data = (void *)curl_ca_embed;
+    blob.data = CURL_UNCONST(curl_ca_embed);
     blob.len = strlen((const char *)curl_ca_embed);
     blob.flags = CURL_BLOB_NOCOPY;
     notef(config->global,

src/tool_operhlp.c

@@ -210,16 +210,16 @@ CURLcode get_url_file_name(struct GlobalConfig *global,
         }
       }
 
-      if(pc)
+      if(pc) {
         /* duplicate the string beyond the slash */
-        pc++;
+        *filename = strdup(pc + 1);
+      }
       else {
         /* no slash => empty string, use default */
-        pc = (char *)"curl_response";
-        warnf(global, "No remote file name, uses \"%s\"", pc);
+        *filename = strdup("curl_response");
+        warnf(global, "No remote file name, uses \"%s\"", *filename);
       }
 
-      *filename = strdup(pc);
       curl_free(path);
       if(!*filename)
         return CURLE_OUT_OF_MEMORY;

src/tool_setopt.c

@@ -252,7 +252,7 @@ static char *c_escape(const char *str, curl_off_t len)
                                 /* Octal escape to avoid >2 digit hex. */
                                 (len > 1 && ISXDIGIT(s[1])) ?
                                   "\\%03o" : "\\x%02x",
-                                (unsigned int) *(unsigned char *) s);
+                                (unsigned int) *(const unsigned char *) s);
       }
     }
   }

src/tool_urlglob.c

@@ -609,7 +609,7 @@ CURLcode glob_match_url(char **result, const char *filename,
                         struct URLGlob *glob)
 {
   char numbuf[18];
-  const char *appendthis = (char *)"";
+  const char *appendthis = "";
   size_t appendlen = 0;
   struct curlx_dynbuf dyn;
 

src/tool_writeout.c

@@ -427,7 +427,7 @@ static int writeString(FILE *stream, const struct writeoutvar *wovar,
     if(use_json)
       fprintf(stream, "\"%s\":null", wovar->name);
   }
-  curl_free((char *)freestr);
+  curl_free((char *)CURL_UNCONST(freestr));
 
   curlx_dyn_free(&buf);
   return 1; /* return 1 if anything was written */

src/tool_writeout_json.c

@@ -38,7 +38,7 @@
 int jsonquoted(const char *in, size_t len,
                struct curlx_dynbuf *out, bool lowercase)
 {
-  const unsigned char *i = (unsigned char *)in;
+  const unsigned char *i = (const unsigned char *)in;
   const unsigned char *in_end = &i[len];
   CURLcode result = CURLE_OK;
 

src/var.c

@@ -60,7 +60,7 @@ void varcleanup(struct GlobalConfig *global)
   while(list) {
     struct tool_var *t = list;
     list = list->next;
-    free((char *)t->content);
+    free(CURL_UNCONST(t->content));
     free(t);
   }
 }
@@ -310,7 +310,7 @@ ParameterError varexpand(struct GlobalConfig *global,
           struct curlx_dynbuf buf;
           const struct tool_var *v = varcontent(global, name, nlen);
           if(v) {
-            value = (char *)v->content;
+            value = (char *)CURL_UNCONST(v->content);
             vlen = v->clen;
           }
           else
@@ -500,7 +500,7 @@ ParameterError setvariable(struct GlobalConfig *global,
     line++;
     clen = strlen(line);
     /* this is the exact content */
-    content = (char *)line;
+    content = (char *)CURL_UNCONST(line);
     if(startoffset || (endoffset != CURL_OFF_T_MAX)) {
       if(startoffset >= (curl_off_t)clen)
         clen = 0;