Fix based on Coverity and Sonar audits (part 1) (#22329)

* cgroups: fix unsigned underflow OOB in convert_cgroup_to_systemd_service Sonar c:S3519 (BLOCKER): the reverse-scan loops in convert_cgroup_to_systemd_service() used `while (len--)` on a `size_t`, so when the input contained no separator the loop ran to completion and the post-decrement on len == 0 wrapped to SIZE_MAX. The subsequent `if (len)` was true and `s[len] = '\0'` wrote far out of bounds. The dot-search was the explicitly flagged path; the slash-search had the same wrap pattern but was accidentally benign because `&s[SIZE_MAX + 1]` wrapped back to `&s[0]`. Replace both reverse scans with strrchr() and an explicit non-NULL, non-leading check. Preserves the existing behavior for valid inputs (separator at index > 0 truncates / repositions; separator at index 0 or absent leaves the string unchanged) and removes the unsigned-underflow path. * apps.plugin: replace single-iteration while with if in comm_from_cmdline_sanitized Sonar c:S1751: comm_from_cmdline_sanitized() used `while (start)` to process the first occurrence of `comm` in the duplicated command-line buffer, but the body unconditionally returns and `start` is never updated -- the loop could never iterate twice. Replace with `if (start)` for accurate intent. No behavior change. * ebpf.plugin: drop unsigned unary minus in zombie counter computation Sonar c:S876: ebpf_update_global_publish() computed `zombie = exit + (-release_task)` via in-place negation of the unsigned release_task counter. The unary minus on uint64_t is well-defined (modular arithmetic) but is a code smell and was unnecessary -- the intent was simple subtraction. Replace with a direct `(long)exit - (long)release_task`, matching the pattern used for `pvc->running` two lines above. Drop the in-place mutation; the release_task counter is not read elsewhere after this block. Numerical result is identical. --------- Co-authored-by: Costa Tsaousis <costa@netdata.cloud>