Make use of `counted_by` gcc/clang attribute

[bluetech]

Since I've read about counted_by I wanted to try it, it seems to work as expected!

There are some preparatory commits, and the last commit contains the details.

@wismill I'll leave the decision whether to merge it to you. The main catch is that it requires some care that the len is always valid even during initialization (see commit for details). I see that CI already has a run with -fsanitize=undefined, so at least covered code should be safe (I fixed what it caught already), but uncovered code might not be.

[wismill]

Rebased after merging the independent commits in #939.

[wismill]

@bluetech that seems a very interesting feature. Are there any relevant runtime costs though?

[bluetech]

@bluetech that seems a very interesting feature. Are there any relevant runtime costs though?

Good question. There is a performance overhead due to additional bounds checking when _FORTIFY_SOURCE=3 is used.

In bench/compile-keymap I don't see a measurable difference. I do see a ~3% difference in bench/compose.c. To "pay" for it, I sent #940.

For the benchmarking I used Arch Linux's default flags (importantly _FORTIFY_SOURCE=3 is set) on "AMD Ryzen AI 9 HX 370" CPU, clang version 21.1.5.

CFLAGS="-march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions \
        -Wp,-D_FORTIFY_SOURCE=3 -Wformat -Werror=format-security \
        -fstack-clash-protection -fcf-protection \
        -fno-omit-frame-pointer -mno-omit-leaf-frame-pointer"
LDFLAGS="-Wl,-O1 -Wl,--sort-common -Wl,--as-needed -Wl,-z,relro -Wl,-z,now \
         -Wl,-z,pack-relative-relocs"
LTOFLAGS="-flto=auto"
exec meson setup \
  --prefix        /usr \
  --libexecdir    lib \
  --sbindir       bin \
  --buildtype     plain \
  --auto-features enabled \
  --wrap-mode     nodownload \
  -D              b_pie=true \
  -D              python.bytecompile=1 \
  "$@"