Harden compiler flags, simplify CWE-134 script, fix bugs found by new warnings

configure.ac:
- Replace basic -Wformat/-Wformat-nonliteral with -Wformat=2
- Add -Wextra, -Wnull-dereference, -Wpointer-arith, -Wimplicit-function-declaration
- Add -fstack-protector-strong, -fno-common, -D_FORTIFY_SOURCE=2
- Add GCC-specific flags via AC_COMPILE_IFELSE: -Wlogical-op, -Wduplicated-cond,
  -Wduplicated-branches, -Wstringop-overflow
- Add linker hardening via AC_LINK_IFELSE: -Wl,-z,relro -Wl,-z,now
- Suppress noisy -Wextra sub-warnings: -Wno-unused-parameter,
  -Wno-missing-field-initializers, -Wno-sign-compare, -Wno-cast-function-type
- Remove AM_CFLAGS/CFLAGS duplication line

check-cwe134.sh:
- Reduce from 5 checks to 2 (checks 1-3 are now redundant with -Wformat=2)
- Check 1: verify known wrappers have G_GNUC_PRINTF attribute
- Check 2: auto-detect unannotated variadic printf-like functions

Bug fixes found by -Wduplicated-branches:
- chatlog.c: non-MUCPM redact path passed resourcepart instead of NULL
- rosterwin.c: two instances of if/else with identical branches in roster count
- omemo.c: redundant else-if branch in omemo_automatic_start

Other fixes for new warnings:
- console.c: pointer compared to integer 0 instead of NULL (2 instances)
- vcard.c: NULL guard for filename before g_file_set_contents
- files.c: refactor to early return, eliminating NULL logfile path
- database.c: const-correctness for type, query, sort variables
- form.c/xmpp.h: const-correctness for form_set_value parameter
- muc.c/muc.h: remove meaningless top-level const on return type
- common.c: const-correctness for URL string literal
- xmpp/omemo.c: scope block for declarations after goto, move from decl
  before goto, replace goto with direct return
- http_common.h: add G_GNUC_PRINTF attributes for http_print_transfer*
- test_common.c: add currb NULL check to silence -Wnull-dereference

tests/unittests/test_common.c

@@ -515,7 +515,7 @@ _lists_equal(GSList* a, GSList* b)
     GSList* curra = a;
     GSList* currb = b;
 
-    while (curra) {
+    while (curra && currb) {
         int aval = GPOINTER_TO_INT(curra->data);
         int bval = GPOINTER_TO_INT(currb->data);