Fix Coverity static analysis warnings

[nanangizz]

Summary

Address multiple Coverity Scan findings across pjlib, pjlib-util, pjmedia, pjnath, and pjsip:

• UNINIT (7 CIDs): Zero-initialize chal_param struct in all pjsip_auth_clt_async_impl_on_challenge() call sites so user_data is not left uninitialized
• LOCK_EVASION: Move Opus codec output frame writes before mutex unlock in codec_decode(), consistent with other return paths
• NO_EFFECT: Use #if preprocessor guard for PJ_SSL_SEND_OP_ACTIVE_MAX check, eliminating unsigned->=0 tautology at default value
• SLEEP: Release mutex before pj_ioqueue_unregister() in ioqueue unregister test callback to avoid potential blocking under lock
• TAINTED_SCALAR (2 CIDs): Add explicit payload length bounds in WebSocket frame decoders (test + production)
• CHECKED_RETURN (4 CIDs): Check pjlib_util_init()/pjnath_init() return values in sample apps and pjturn-srv. In strerror.c, return values are cast to (void) instead — this sample intentionally continues on partial init failure since its purpose is translating error codes and partial initialization still covers other error ranges.

Not addressed (false positives)

• WRAPPER_ESCAPE (5 CIDs): unique_ptr<TestAccount> correctly manages Account lifetime via RAII destructor
• REVERSE_INULL (1 CID): udp is always non-NULL at dereference point; null check at cleanup is defensive for goto pattern

Test plan

• Build passes (zero errors, zero new warnings)
• CI

Co-Authored-By: Claude Code

[Copilot]

Pull request overview

This PR addresses multiple Coverity static analysis findings across the SIP stack, media codec, SSL socket code, WebSocket framing, tests, and sample applications to improve correctness and avoid flagged patterns.

Changes:

• Zero-initialize pjsip_auth_clt_async_on_chal_param at async-auth challenge call sites to avoid copying uninitialized fields.
• Adjust locking/order-of-operations to avoid Coverity concurrency findings (Opus decode output writes; ioqueue unregister callback).
• Add bounds checks / preprocessor guards and improve return-value handling in select utilities, tests, and sample apps.

Reviewed changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
pjsip/src/pjsua-lib/pjsua_im.c	Zero-initialize async auth challenge param in IM callbacks.
pjsip/src/pjsip/sip_dialog.c	Zero-initialize async auth challenge param in dialog response handler.
pjsip/src/pjsip-ua/sip_reg.c	Zero-initialize async auth challenge param in regc transaction callback.
pjsip/src/pjsip-ua/sip_inv.c	Zero-initialize async auth challenge param across INVITE-related challenge handlers.
pjsip/src/pjsip-simple/publishc.c	Zero-initialize async auth challenge param in PUBLISH client handler.
pjsip/src/pjsip-simple/evsub.c	Zero-initialize async auth challenge param in event subscription handlers.
pjsip-apps/src/samples/strerror.c	Changes handling of init return values (currently explicitly ignored).
pjsip-apps/src/samples/httpdemo.c	Check pj_init() and pjlib_util_init() return values.
pjsip-apps/src/samples/clidemo.c	Check pj_init() and pjlib_util_init() return values.
pjnath/src/pjturn-srv/main.c	Check pjlib_util_init() / pjnath_init() return values.
pjmedia/src/pjmedia-codec/opus.c	Write to output before unlocking mutex on the “buffer first packet” path.
pjlib/src/pjlib-test/ioq_unreg.c	Unlock mutex before calling pj_ioqueue_unregister() in callback.
pjlib/src/pj/ssl_sock_imp_common.c	Replace tautological runtime check with #if PJ_SSL_SEND_OP_ACTIVE_MAX > 0.
pjlib-util/src/pjlib-util/websock.c	Add explicit payload length cap check in frame decode helper.
pjlib-util/src/pjlib-util-test/websock_test.c	Add explicit payload length cap in test frame decoder.