Add static code analysis tooling

This adds some nice static analysis tools, and fixes whatever warnings they were giving.

The only thing missing is checking the docs, but we can only enable that once the API stabilizes and we start to document things.