JIT has several good uses of unsigned integer wraparounds, that
clang's UBSAN doesn't like (which is controversial, because it is
clearly not undefined behaviour), but since it is usually good to
know when they happen by accident it makes sense to make sure the
rest of PCRE2 codebase benefits from checking it.
While at it, upgrade the version of the base image to use a newer
OS as a canary from when the rest of the jobs upgrade themselves
and be a little more strict to catch other constructs that are not
welcomed in our codebase.