build: Pikaur-safe hardening flags, opt-in sanitizers, -Wsign-compare

Re-introduce the build hardening that 5459e78e8 attempted, in a form that
coexists with Arch/Pikaur builds (the conflict that forced its revert in
0722dc9e3).

configure.ac:
- Add -D_FORTIFY_SOURCE=2 only when neither $CFLAGS nor $CPPFLAGS already
  define _FORTIFY_SOURCE (makepkg injects its own) and not under --coverage.
- Route glib/gio CFLAGS through -isystem so their macros don't trip our -W set.
- Add --enable-sanitizers (ASan + UBSan; unsigned-integer-overflow probed,
  skipped on gcc) for a dedicated CI job, off by default.
- Add --enable-hardening to gate -Wnull-dereference (false positives under
  -O2 on some toolchains), off by default.
- Promote -Wsign-compare from -Wno- to an active probed warning.

Also fix the sign-conversion sites that -Wsign-compare/-Wconversion cleanup
surfaced as safe (pointer-diff to gsize via new g_diff_to_gsize helper,
non-negative int casts), and validate the /vcard remove index through
strtoi_range so a negative argument can no longer become a huge unsigned
index.

Refs #112

src/xmpp/jid.c

@@ -117,7 +117,7 @@ jid_is_valid(const gchar* const str)
 
     // Localpart validation
     if (at) {
-        size_t local_len = at - str;
+        size_t local_len = g_diff_to_gsize(at, str);
         if (local_len == 0 || local_len > JID_MAX_PART_LEN) {
             return FALSE;
         }
@@ -135,7 +135,7 @@ jid_is_valid(const gchar* const str)
 
     // Resourcepart validation if present
     if (slash) {
-        domain_len = slash - domain_start;
+        domain_len = g_diff_to_gsize(slash, domain_start);
         size_t resource_len = strlen(slash + 1);
         if (resource_len > JID_MAX_PART_LEN) {
             return FALSE;

src/xmpp/muc.c

@@ -707,7 +707,7 @@ muc_autocomplete(ProfWin* window, const char* const input, gboolean previous)
     } else {
         search_str = last_space + 1;
         if (!chat_room->autocomplete_prefix) {
-            chat_room->autocomplete_prefix = g_strndup(input, search_str - input);
+            chat_room->autocomplete_prefix = g_strndup(input, g_diff_to_gsize(search_str, input));
         }
     }