build: set `-Werror`

[t-bre]

Description

Compilers should be set to error on warnings.

Rationale: build caching means that a warning can appear once when you build the file, and then not appear again until you clean the build system. This makes it easier for warnings to slip through. Theoretically the linter should catch it, but it's better to be safe.

If we can find a way to make cmake remember previous warnings and print them out again that would be a reasonable alternative.