Improve project stability/robustness via code auditing tools

Nobody has claimed this yet.

I discovered #3948 by enabling the Clang "Address Sanitizer" in debug mode.

It would probably be good to have this as a configuration option and/or automatically enabled for `Debug` builds. There is a performance impact from having this enabled but I don't know how significant.

There are other tools/options it would be a good idea to use/run over the code base (noted here for future reference):

* [`AddressSanitizer`](https://clang.llvm.org/docs/AddressSanitizer.html)
* [`LeakSanitizer`](https://clang.llvm.org/docs/LeakSanitizer.html)
* `MemorySanitizer`
* `ThreadSanitizer`
* [`Clang-Tidy`](http://clang.llvm.org/extra/clang-tidy/) -- "clang-based C++ 'linter' tool"
* [`clazy`](https://github.com/KDE/clazy) -- "Qt oriented code checker based on clang framework."
* Valgrind
* [stoat](https://www.github.com/fundamental/stoat) ([via](https://github.com/LMMS/lmms/issues/3950#issuecomment-342803300))

I'll look at enabling as many of the options during my usual development as possible and will take a look at the static analysis tools when I have the opportunity. It would be good if others were able to do the same.

This ticket can be closed for project management purposes.

Start by reviewing issue #3948 and the Debug-build configuration, then compare the listed sanitizer and static-analysis tools. The issue does not identify files, tests, a chosen tool, or a defined completion criterion; done would require narrowing the scope and agreeing whether any tool should be configurable or automatically enabled.

Written by the indexing model from the issue text.