ctype(3): Fix versions and clarify what LIBC_ALLOWCTYPEABUSE does.

Both the extra diagnostics _and_ LIBC_ALLOWCTYPEABUSE are new in 11.
The extra diagnostics were not added in 10 (unless someone went ahead
and pulled them up while I wasn't looking!).

LIBC_ALLOWCTYPEABUSE doesn't guarantee that the program won't crash;
it just makes that depend on factors such as address space layout
randomization -- where the ctype tables appear in memory relative to
non-readable pages.

PR lib/58208: ctype(3) provides poor runtime feedback of abuse

Author: riastradh

lib/libc/gen/ctype.3

@@ -1,4 +1,4 @@
-.\"	$NetBSD: ctype.3,v 1.34 2025/10/05 00:29:37 riastradh Exp $
+.\"	$NetBSD: ctype.3,v 1.35 2025/10/05 00:35:47 riastradh Exp $
 .\"
 .\" Copyright (c) 1991 Regents of the University of California.
 .\" All rights reserved.
@@ -62,18 +62,18 @@ See the specific manual pages for information about the
 test or conversion performed by each function.
 .Sh ENVIRONMENT
 In
-.Nx 10 ,
+.Nx 11 ,
 the
 .Nm
-functions will crash with a signal on certain invalid inputs as a
-diagnostic aid for applications; see
+functions will always crash with a signal on certain invalid inputs as
+a diagnostic aid for applications; see
 .Sx CAVEATS .
-In
-.Nx 11 ,
-setting the environment variable
+Setting the environment variable
 .Ev LIBC_ALLOWCTYPEABUSE
-before starting a program will make the functions return nonsense
-answers instead of crashing.
+before starting a program will restore the old behavior of returning
+nonsense answers for these inputs, or sometimes but not always
+crashing, depending on factors such as address space layout
+randomization.
 .Sh EXAMPLES
 To print an upper-case version of a string to stdout,
 the following code can be used: