BUILD: makefile: extract -Werror/-Wfatal-errors from automatic CFLAGS

BUILD: makefile: extract -Werror/-Wfatal-errors from automatic CFLAGS

The compiler-specific CFLAGS that are automatically detected (SPEC_CFLAGS)
are currently the ones affected by ERR and FAILFAST. Not only this makes
these options useless as soon as SPEC_CFLAGS is forced, but it also means
that any change to them causes a rebuild, so disabling FAILFAST or
enabling ERR to get more info on a faulty object causes a full rebuild
of all others. Let's just move them to ERROR_CFLAGS that only contains
these two.  It's not documented outside of the makefile because it's not
supposed to be touched.