build: sync scan-build target with CI

Changes:

* Use --status-bugs in the scan-build target to exit with an error if
  bugs are found
* Call the make target in the CI job

.github/workflows/check-c.yml

@@ -67,11 +67,11 @@ jobs:
       run: ./ci/printenv.sh
     - name: configure
       run: >
-        CC=clang-14 ./configure --enable-fatal-warnings --enable-apparmor
-        --enable-selinux
+        ./configure CC=clang-14 SCAN_BUILD=scan-build-14
+        --enable-fatal-warnings --enable-apparmor --enable-selinux
         || (cat config.log; exit 1)
     - name: scan-build
-      run: scan-build-14 --status-bugs make
+      run: make scan-build
 
   cppcheck:
     runs-on: ubuntu-22.04

Makefile

@@ -374,7 +374,7 @@ cppcheck-old: clean
 
 .PHONY: scan-build
 scan-build: clean
-	$(SCAN_BUILD) $(MAKE)
+	$(SCAN_BUILD) --status-bugs $(MAKE)
 
 # TODO: Old codespell versions (such as v2.1.0 in CI) have issues with
 # contrib/syscalls.sh