drop -O2 from CC_CHECK_CFLAGS_APPEND

autotools adds its own -O2, so it appeared twice
make main.c splint parseable again

This commit is kind of ugly, cause it doesn't fix indentation. It just
necessary to get any sensible diagnostics out of splint.
node: fix logic error in env parsing
node: fix misuse of strtok
node: turn ip_bind_as_str non-global

Only used in one function. We can actually free it after usage.
node: initialize a s_plugin_conf

parse_plugin_conf, which takes it, expects that.
node: splint function annotations
adding extra -W flags
node: fix warning "array subscript is above array bounds"
mnc: the config options are " " separated