Add -Werror semantics to the CMake build

While MESOS-8658 got us to warning-parity with Autotools, we still don't have -Werror turned on because we need to figure out precisely which it'll apply to. Autotools adds it to MESOS_CPPFLAGS which are then included in almost all targets under src, but when we tried the equivalent via add_compile_options we had issues due to warnings from protobufs.

Ideally we turned it on using target_compile_options(foo PRIVATE) so that it's not directory-wide nor inheritable; but that'll mean figuring out which targets to turn it on for. We probably should turn it on for stout-tests, libprocess, and libprocess-tests too, which the Autotools build does not yet do.