Unfortunately we cannot indiscriminately replace xfree() with
XFREE_CLEAR(), because comparing pointers after freeing them is a common
pattern. Example in `tv_list_remove_items()`:

    xfree(li);
    if (li == item2) {
      break;
    }

Instead we can do it selectively/explicitly.

ref #1375

ref #10012

- don't underflow itr->p pointer (C standard only allows one past the end, not
  one before the beginning)
- make sure itr->p->i is always initialized (even when not used)
- don't rely on `NULL < &object` (likely UB)

- Minimum required libuv is now v1.12
- Because `uv_os_getenv` requires allocating, we must manage a map
  (`envmap` in `env.c`) to maintain the old behavior of `os_getenv` .
- free() map-items after removal. khash.h does not make copies of
  anything, so even its keys must be memory-managed by the caller.

closes #8398
closes #9267

Add ext_newgrid and ext_hlstate extensions. These use predefined
highlights and line-segment based updates, for efficiency and
simplicity.. The ext_hlstate extension in addition allows semantic
identification of builtin and syntax highlights.

Reimplement the old char-based updates in the remote UI layer, for
compatibility. For the moment, this is still the default. The bulitin
TUI uses the new line-based protocol.

cmdline uses curwin cursor position when ext_cmdline is active.

MSVC has the __restrict keyword and a marco is defined for it in `win_defs.h`.

We need to disable -Warray-bounds locally for kbtree.h, but we can't
because _Pragma("GCC diagnostic pop") is broken in GCC 5.x+.

So this commit disables -Warray-bounds entirely (for GCC only).

GCC bug:
"_Pragma diagnostic 'ignored' in macro with strict-overflow not
suppressing warning fully with -Werror"
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66099

ref https://github.com/neovim/neovim/pull/7083#issuecomment-326323599
closes #7921

First stage: something compiling without klee, but with a buch of dirty
hacks - done.
Second stage: something running under klee, able to emit useful results,
but still using dirty hacks - done.

Third stage: make CMake care about clang argumnets - not done, may be
omitted if proves to be too hard. Not that klee can be run on CI in any
case.