cmake: enable -O2 optimizations and debug symbols by default, but make these overridable by user
Sync with the OBS

Changes:
- enable build hardening on the RPM distros
- respect CXXFLAGS (if any) on deb-based ones

This synces with r212 of trojita-nightly and r96 of trojita.