strerror: use sys_errlist instead of strerror on Windows

[jay]

• Change Curl_strerror to use sys_errlist[errnum] instead of strerror to
  retrieve the error message on Windows.

Windows' strerror writes to a static buffer and is not thread-safe.

Follow-up to 2f0bb86 which removed most instances of strerror in favor
of calling Curl_strerror (which calls strerror_r for other platforms).

Ref: #7685
Ref: 2f0bb86

Closes #xxxx

[bagder]

👍

[MarcelRaad]

👍

[mback2k]

@jay it seems like Microsoft deprecated direct access to sys_errlist, see: https://docs.microsoft.com/en-us/cpp/c-runtime-library/errno-doserrno-sys-errlist-and-sys-nerr

Direct access to _sys_errlist and _sys_nerr is deprecated for code-security reasons. We recommend that you use the more secure, functional versions instead of the global macros, as shown here: ...

[jay]

Yes that's right however it's in all versions of the CRT and strerror_s is not.

[mback2k]

Yes that's right however it's in all versions of the CRT and strerror_s is not.

Okay, what do you think about checking for the availability of strerror_s and using that if available?

[jay]

I'm not aware of runtime checks for CRT functions so it would require a compile time check. The documentation does not say when the function was introduced. Frankly I don't think some of these "deprecations" from MS are true, like we're not going to stop using strncpy for strncpy_s or any of the other functions for the _s series. So I appreciate the point if you want to make a PR for strerror_s I won't object I just think it's sufficient as is.

[jay]

Note also how they define deprecated: In this context, "deprecated" means using the function's isn't recommended. It doesn't mean the function is scheduled to be removed from the CRT.