build: Pikaur-safe hardening flags, opt-in sanitizers, -Wsign-compare

Re-introduce the build hardening that 5459e78e8 attempted, in a form that
coexists with Arch/Pikaur builds (the conflict that forced its revert in
0722dc9e3).

configure.ac:
- Add -D_FORTIFY_SOURCE=2 only when neither $CFLAGS nor $CPPFLAGS already
  define _FORTIFY_SOURCE (makepkg injects its own) and not under --coverage.
- Route glib/gio CFLAGS through -isystem so their macros don't trip our -W set.
- Add --enable-sanitizers (ASan + UBSan; unsigned-integer-overflow probed,
  skipped on gcc) for a dedicated CI job, off by default.
- Add --enable-hardening to gate -Wnull-dereference (false positives under
  -O2 on some toolchains), off by default.
- Promote -Wsign-compare from -Wno- to an active probed warning.

Also fix the sign-conversion sites that -Wsign-compare/-Wconversion cleanup
surfaced as safe (pointer-diff to gsize via new g_diff_to_gsize helper,
non-negative int casts), and validate the /vcard remove index through
strtoi_range so a negative argument can no longer become a huge unsigned
index.

Refs #112

src/profanity.c

@@ -105,7 +105,7 @@ prof_run(gchar* log_level, gchar* account_name, gchar* config_file, gchar* log_f
                      * so we can be sure there's runtime left after executing
                      * the last command.
                      */
-                    min_runtime += waittime;
+                    min_runtime += (unsigned int)waittime;
                 } else {
                     log_error("%s", err_msg);
                     g_free(err_msg);