make: Build with -Werror by default

Can be overridden from the environment by setting WERROR=0

also remove reversed logic for Werror in Makefile.buildtest
(a typo caused Werror to be always enabled for all builds)