ci: Enable -fanalyzer

Followup to https://github.com/ostreedev/ostree/pull/2463

One thing I noticed here is we lost usage of `build-check.sh`
which also invokes `clang`, which doesn't speak `-fanalyzer`
and would be broken by this if we try to enable `build-check.sh`
again.  But that can come later.

ci/build.sh

@@ -30,6 +30,6 @@ esac
 
 # always fail on warnings; https://github.com/ostreedev/ostree/pull/971
 # NB: this disables the default set of flags from configure.ac
-export CFLAGS="-Wall -Werror ${CFLAGS:-}"
+export CFLAGS="-Wall -Werror -fanalyzer ${CFLAGS:-}"
 
 build --enable-gtk-doc ${CONFIGOPTS:-}