It remains a private static library. Neither libvarnishapi nor test
cases from libvarnish use individual source files besides the ones
containing test drivers.

It can lead to very cryptic messages where a symbol is defined twice
from different sources, where the sources are the same but the object
code is technically different (a copy built from _SOURCES and a copy
in libvarnish.a).

While at it, add sanitizers flags to all libvarnish test cases.