add clang-analyze target for enabling static analysis

We run this in the travis builds, but we don't make things fatal because
the false positive rate is > 50%.

It did find a couple of real issues in the buf code though, so it's
worth keeping