clang had 5 reports against virCommand; three were false positives
(a NULL deref in ProcessIO solved by sa_assert, and two uninitialized
memory operations solved by adding an initializer), but two were real.

* src/util/command.c (virCommandProcessIO): Fix real bug of
possible NULL dereference.  Teach clang that buf is never NULL.
(virCommandRun): Teach clang that infd is only ever accessed when
initialized.