ci lint:scan-build: work around changes in meson

In 1f7678ea meson was updated and that broke our scan-build.
Now we work around that.  Quick analysis of why:
https://github.com/mesonbuild/meson/pull/5918#issuecomment-762064902

.gitlab-ci.yml

@@ -200,7 +200,7 @@ lint:scan-build:
     paths:
       - build_ci*/meson-logs/scanbuild
   script:
-    - export SCANBUILD="scan-build --status-bugs -no-failure-reports $(./scripts/get-scanbuild-args.sh)"
+    - export SCANBUILD="$(realpath ./scripts/run-scanbuild-with-args.sh)"
     - ninja -C build_ci* scan-build || true
     - test "$(ls build_ci*/meson-logs/scanbuild/*/report-*.html | wc -l)" = 23 # we have this many errors ATM :-)
 

scripts/get-scanbuild-args.sh → scripts/run-scanbuild-with-args.sh

@@ -15,7 +15,7 @@ set -o errexit -o nounset
 # alpha.deadcode.UnreachableCode # false positives/flags sanity checks depending on implementation details
 # alpha.security.MallocOverflow # not smart enough to infer max values from data types
 
-cat <<-EOF
+exec scan-build --status-bugs -no-failure-reports \
 -disable-checker  unix.Malloc \
 -enable-checker   alpha.core.BoolAssignment \
 -enable-checker   alpha.core.CallAndMessageUnInitRefArg \
@@ -48,5 +48,5 @@ cat <<-EOF
 -enable-checker   security.FloatLoopCounter \
 -enable-checker   valist.CopyToSelf \
 -enable-checker   valist.Uninitialized \
--enable-checker   valist.Unterminated
-EOF
+-enable-checker   valist.Unterminated \
+"$@"