tech debt: eliminate static variables

[ennorehling]

When running valgrind with --show-reachable=yes --leak-check=full, it currently reports 131 memory leaks, and all but four of them are classified as "reachable", meaning they are probably in some static variable. There are way too many of those in the code, and they hide problems.

I've annotated a lot of these before, so there are some comments to look for low-hanging fruit: FIXME: static return value STATIC_XCALL: used across calls STATIC_LEAK: malloc in static variable