[scan-build] Log compiler invocation to stderr, not stdout.

This is important for preprocessing steps, which may output to stdout.

Also, change ENV accesses using barewords to use string keys instead.

PR16414

llvm-svn: 185555