Fix based on Coverity and Sonar audits (part 1) - #22329

* cgroups: fix unsigned underflow OOB in convert_cgroup_to_systemd_service

Sonar c:S3519 (BLOCKER): the reverse-scan loops in
convert_cgroup_to_systemd_service() used `while (len--)` on a `size_t`,
so when the input contained no separator the loop ran to completion and
the post-decrement on len == 0 wrapped to SIZE_MAX. The subsequent
`if (len)` was true and `s[len] = '\0'` wrote far out of bounds.

The dot-search was the explicitly flagged path; the slash-search had the
same wrap pattern but was accidentally benign because `&s[SIZE_MAX + 1]`
wrapped back to `&s[0]`.

Replace both reverse scans with strrchr() and an explicit non-NULL,
non-leading check. Preserves the existing behavior for valid inputs
(separator at index > 0 truncates / repositions; separator at index 0 or
absent leaves the string unchanged) and removes the unsigned-underflow
path.

* apps.plugin: replace single-iteration while with if in comm_from_cmdline_sanitized

Sonar c:S1751: comm_from_cmdline_sanitized() used `while (start)` to
process the first occurrence of `comm` in the duplicated command-line
buffer, but the body unconditionally returns and `start` is never
updated -- the loop could never iterate twice. Replace with `if (start)`
for accurate intent. No behavior change.

* ebpf.plugin: drop unsigned unary minus in zombie counter computation

Sonar c:S876: ebpf_update_global_publish() computed
`zombie = exit + (-release_task)` via in-place negation of the unsigned
release_task counter. The unary minus on uint64_t is well-defined
(modular arithmetic) but is a code smell and was unnecessary -- the
intent was simple subtraction.

Replace with a direct `(long)exit - (long)release_task`, matching the
pattern used for `pvc->running` two lines above. Drop the in-place
mutation; the release_task counter is not read elsewhere after this
block. Numerical result is identical.

---------

Co-authored-by: Costa Tsaousis <costa@netdata.cloud>
(cherry picked from commit 83179b7)