build: enable warnings about signed-unsigned compare and fix one problem in tests

This is enabled on Qt5 by default, apparently, so it never hurts to have it
always active.
build: add options for -Werror to the CI

When cmake is run with -DDEV_FATAL_WARNINGS=ON, all warnings are turned into
errors. The idea is that Trojita compiles warning-free, and it shall remain so.

This is, however, *not* enabled for the end-user builds because experience of a
ton of other projects shows that sooner or later a compiler will come up with a
new, incompatible diagnostics which simply breaks everything.