[scan-build] Log compiler invocation to stderr, not stdout.

This is important for preprocessing steps, which may output to stdout.

Also, change ENV accesses using barewords to use string keys instead.

PR16414