Fix UAF and enable ASan in CI, without leak checks

Use address sanitizer to catch use-after-free and other errors when running the test suite.

Leak detection is disabled, because currently there are too many leaks, making almost all tests fail otherwise. Small steps.

Really lucky that there was exactly one bug to be fixed before the test suite runs fine with ASan enabled locally for me. Things weren't horribly broken, but broken enough to prove the point of ASan.

Maybe in the future we can fix also the leaks and enable leak detection too.