Makefile: add hardening stuff to CFLAGS