Fix scan-build reports and gate CI pipeline success on scan-build success

This is a follow-up from !563 (merged).

We need to squash all the scan-build reports, then add the following to .gitlab-ci.yml to gate pipeline success on there being no analysis reports:

variables:
  # Exit with a non-zero status if any bugs are found
  SCANBUILD: "scan-build --status-bugs"

This requires a Meson version bump to ≥ 0.49.0 to include the fix for https://github.com/mesonbuild/meson/issues/4334.

There’s an FAQ on the clang analyser which gives workarounds for common false positives: http://clang-analyzer.llvm.org/faq.html