build: enable -Wconversion/-Wsign-compare and add --enable-sanitizers

Turn on the stricter conversion-safety warnings and wire in an optional
sanitizer build mode. Nothing is promoted to a hard error yet: the
warnings become part of the build output and can be cleaned up
incrementally without blocking development.

- Drop -Wno-sign-compare and add -Wsign-compare + -Wconversion to the
  GCC-specific warnings loop (probed for compiler support).
- Add --enable-sanitizers flag that enables ASan + UBSan +
  -fsanitize=unsigned-integer-overflow with -fno-sanitize-recover=all.
  Off by default; intended for a dedicated CI job.
- Under PACKAGE_STATUS=development (-Werror), opt out of turning the
  new conversion/sign-compare warnings into hard errors via
  -Wno-error=sign-conversion/-conversion/-float-conversion/-sign-compare.
  Existing codebase has ~240 sign-conversion, ~87 other narrowing and a
  handful of sign-compare warnings (mostly inherited from upstream);
  they stay visible but don't block development builds.
- Route glib/gio CFLAGS through -isystem so macros like
  GPOINTER_TO_UINT in glibconfig.h don't generate noise.

configure.ac

@@ -71,6 +71,8 @@ AC_ARG_ENABLE([omemo-qrcode],
     [AS_HELP_STRING([--enable-omemo-qrcode], [enable ability to display omemo qr code])])
 AC_ARG_ENABLE([coverage],
     [AS_HELP_STRING([--enable-coverage], [enable code coverage analysis])])
+AC_ARG_ENABLE([sanitizers],
+    [AS_HELP_STRING([--enable-sanitizers], [enable AddressSanitizer + UndefinedBehaviorSanitizer + unsigned-integer-overflow])])
 
 m4_include([m4/ax_valgrind_check.m4])
 AX_VALGRIND_DFLT([drd], [off])
@@ -386,7 +388,7 @@ AC_SUBST([FORKPTY_LIB])
 
 ## Default parameters
 AM_CFLAGS="$AM_CFLAGS -Wall -Wextra -Wformat=2 -Wno-format-zero-length"
-AM_CFLAGS="$AM_CFLAGS -Wno-deprecated-declarations -Wno-unused-parameter -Wno-missing-field-initializers -Wno-sign-compare -Wno-cast-function-type"
+AM_CFLAGS="$AM_CFLAGS -Wno-deprecated-declarations -Wno-unused-parameter -Wno-missing-field-initializers -Wno-cast-function-type"
 AM_CFLAGS="$AM_CFLAGS -Wnull-dereference -Wpointer-arith"
 AM_CFLAGS="$AM_CFLAGS -Wimplicit-function-declaration"
 AM_CFLAGS="$AM_CFLAGS -Wundef"
@@ -398,7 +400,8 @@ AM_CFLAGS="$AM_CFLAGS -std=gnu99 -ggdb3"
 # GCC-specific warnings (not supported by clang) — test each one
 saved_CFLAGS="$CFLAGS"
 for _flag in -Wlogical-op -Wduplicated-cond -Wduplicated-branches \
-             -Wstringop-overflow -Warray-bounds=2 -Walloc-zero; do
+             -Wstringop-overflow -Warray-bounds=2 -Walloc-zero \
+             -Wsign-compare -Wconversion; do
     AC_MSG_CHECKING([whether $CC supports $_flag])
     CFLAGS="$saved_CFLAGS $_flag -Werror"
     AC_COMPILE_IFELSE([AC_LANG_PROGRAM()],
@@ -425,11 +428,27 @@ AS_IF([test "x$enable_coverage" = xyes],
      AM_LDFLAGS="$AM_LDFLAGS --coverage"
      AC_MSG_NOTICE([Code coverage analysis enabled])])
 
+AS_IF([test "x$enable_sanitizers" = xyes],
+    [SAN_FLAGS="-fsanitize=address,undefined,unsigned-integer-overflow -fno-sanitize-recover=all -fno-omit-frame-pointer"
+     AM_CFLAGS="$AM_CFLAGS $SAN_FLAGS"
+     AM_LDFLAGS="$AM_LDFLAGS -fsanitize=address,undefined"
+     AC_MSG_NOTICE([Sanitizers enabled: ASan + UBSan + unsigned-integer-overflow])])
+
 AS_IF([test "x$PACKAGE_STATUS" = xdevelopment],
-    [AM_CFLAGS="$AM_CFLAGS -Wunused -Werror"])
+    [AM_CFLAGS="$AM_CFLAGS -Wunused -Werror"
+     # -Wconversion emits ~240 sign-conversion and ~84 other narrowing
+     # warnings across the tree (mostly inherited from upstream). Keep
+     # them visible in build logs but let development builds continue;
+     # they will be cleaned up incrementally.
+     AM_CFLAGS="$AM_CFLAGS -Wno-error=sign-conversion -Wno-error=conversion -Wno-error=float-conversion -Wno-error=sign-compare"])
 AS_IF([test "x$PLATFORM" = xosx],
     [AM_CFLAGS="$AM_CFLAGS -Qunused-arguments"])
 
+# Treat glib/gio headers as system so -Wconversion does not scream
+# about GPOINTER_TO_UINT etc. inside glibconfig.h.
+glib_CFLAGS=$(echo "$glib_CFLAGS" | sed 's/-I/-isystem /g')
+gio_CFLAGS=$(echo "$gio_CFLAGS" | sed 's/-I/-isystem /g')
+
 AM_CFLAGS="$AM_CFLAGS $PTHREAD_CFLAGS $glib_CFLAGS $gio_CFLAGS $curl_CFLAGS ${SQLITE_CFLAGS}"
 AM_CFLAGS="$AM_CFLAGS $libnotify_CFLAGS ${GTK_CFLAGS} $python_CFLAGS"
 AM_CFLAGS="$AM_CFLAGS -DTHEMES_PATH=\"\\\"$THEMES_PATH\\\"\" -DICONS_PATH=\"\\\"$ICONS_PATH\\\"\" -DGLOBAL_PYTHON_PLUGINS_PATH=\"\\\"$GLOBAL_PYTHON_PLUGINS_PATH\\\"\" -DGLOBAL_C_PLUGINS_PATH=\"\\\"$GLOBAL_C_PLUGINS_PATH\\\"\""