ci: Set -Werror for all CI builds

This also tidies the list of environment variables in .cirrus.yml.

Author: real-or-random

.cirrus.yml

@@ -1,21 +1,25 @@
 env:
-  WIDEMUL: auto
+  # compiler options
+  HOST:
+  WERROR: yes
+  MAKEFLAGS: -j2
+  EXTRAFLAGS:
+  BUILD: check
+  # secp256k1 config
   STATICPRECOMPUTATION: yes
   ECMULTGENPRECISION: auto
   ASM: no
-  BUILD: check
+  WIDEMUL: auto
   WITH_VALGRIND: yes
   RUN_VALGRIND: no
-  EXTRAFLAGS:
-  HOST:
-  ECDH: no
-  RECOVERY: no
-  SCHNORRSIG: no
-  EXPERIMENTAL: no
   CTIMETEST: yes
   BENCH: yes
   ITERS: 2
-  MAKEFLAGS: -j2
+  # secp256k1 modules
+  EXPERIMENTAL: no
+  ECDH: no
+  RECOVERY: no
+  SCHNORRSIG: no
 
 cat_logs_snippet: &CAT_LOGS
   always: