Compare scan-build's [documentation][1]:
> ALWAYS analyze a project in its "debug" configuration
>
> Most projects can be built in a "debug" mode that enables assertions.
> Assertions are picked up by the static analyzer to prune infeasible
> paths, which in some cases can greatly reduce the number of false
> positives (bogus error reports) emitted by the tool.
Closes#3960.
1: http://clang-analyzer.llvm.org/scan-build.html#recommended_debug
Can be overridden from the environment by setting WERROR=0
also remove reversed logic for Werror in Makefile.buildtest
(a typo caused Werror to be always enabled for all builds)