Fixes #26420.

While working on the issue with where found in #26240, I noticed two other related issues. Since the fix for where depends on the other two fixes, I figured it would make sense to send them all as one PR.

First, it turns out that advanced indexing was broken for indexing any entry in an array that needs a heap allocation. On current main, this leads to errors or segfaults:

>>> import numpy as np
>>> a = np.array(["a", "c", "h"*25], dtype=np.dtypes.StringDType(na_object=None))
>>> a[[1,2]]
... elide traceback ...
MemoryError: Failed to load string in StringDType getitem

The fix is to properly set the output descriptor in the casting setup in array_subscript.

Second, I noticed that the nonzero function completely ignores nulls. I also noticed that the string to bool cast assumed all nulls are truthy and ignored the existence of nulls like None that should be falsey, following the behavior of object array:

>>> import numpy as np
>>> np.nonzero(np.array(['hello', np.nan, 'world'], dtype=object))
(array([0, 1, 2]),)
>>> np.nonzero(np.array(['hello', None, 'world'], dtype=object))
(array([0, 2]),)

This updates both nonzero and the string to bool cast to account for this and makes sure they behave identically.

Finally, the issue with where is also caused by not setting the input and output descriptors properly in the cast setup in PyArray_Where. The casting code here dates back to #23770, which was before stringdtype had an arena allocator. With the arena allocator, we need to be more careful about bookkeeping on input and output descriptors. This means we also need to setup a separate cast for the second input descriptor.

Also adds tests for all three fixed issues.