Add ASan and UBSan sanitizers

[asmaloney]

• always on when building tests (Linux & macOS*)
• can be enabled/disabled individually otherwise

Ignores container-overflow (ASan). This is a false positive and there’s no good way to fix it, so turn off the feature.

*I gave up trying to get the address sanitizer working for MSVC (and UBSan isn’t supported), so it’s disabled on MSVC.