cmake: add more hardening compiler flags