Fix phantom imports in the section-less ELF symbol scan ##bin

[phix33]

• Mark this if you consider it ready to merge
• I've added tests (optional)
• I wrote some lines in the book (optional)

Description

.dynsym carries no size tag, so with no section headers the scan bounded it at DT_STRTAB alone. lld places .gnu.hash/.hash — and .gnu.version when symbols are versioned — between .dynsym and .dynstr, so those tables were decoded as symbols:

$ rabin2 -i bins/elf/pltrel/aarch64-bti-lld-one-noshdr.so
3   0x1a00000001 LOCAL OBJ      foo

That line is the gnu-hash header read as an Elf64_Sym: nbuckets (1) became the name index, bloom_size | bloom_shift << 32 became the address. It also appeared in is as imp.foo and in imports_by_ord.

Three commits:

• Bound the scan at DT_STRTAB/DT_GNU_HASH/DT_HASH/DT_VERSYM; DT_GNU_HASH is now parsed.
• The import filter compared st_shndx against SHT_NULL/SHT_DYNSYM — section types, not indices — so a symbol defined in section 11 was emitted as an import (_ftext in bins/elf/analysis/mipsbe-ubusd). It now uses the is_imported it already computes, matching the section-header path.
• Cap the count with DT_HASH's nchain (or DT_MIPS_SYMTABNO), so layouts where every table precedes .dynsym are bounded too; positional bounds remain the fallback. nchain matches the real .dynsym size on 145 of the 146 test binaries carrying both, and the one outlier states a larger count, so the cap cannot truncate.