[analyzer] Model strchr/strrchr/memchr/strstr/strpbrk/strchrnul (#207267)
CStringChecker did not model these buffer-search functions, so the
engine bound each call to a fresh conjured symbol unrelated to the source.
As a consequence, we could not track the origin of the returned pointer,
thus the fact that it shares provenance of the source pointer.
Fixes #203260
Assisted-by: Claude Opus 4.8