Enable address sanitizer in compilations on supported platforms/toolchains

Per https://twitter.com/JSAMcFarlane

Whenever you see examples of 'cursed' C or C++, run it built on GCC/Clang with

-Werror -Wall -Wextra -fsanitize=undefined,address

and see how far it gets. These flags should be enabled by default in IDEs, build systems and for testing and development.

I won't go for -Werror since that would be disruptive (compiler upgrade == broken build). -Wextra might be good, at least as an option.