enable hardening flags

-pedantic not yet, as it fails to accept casting void* function ptrs
-Wl,--as-needed -D_FORTIFY_SOURCE=2 (detects jit stack smashing better)
-fstack-protector-all
fix minor pedantic issues
make: icc fixes, add LDFLAGS for LINK, harden LDFLAGS

now with -Wl,-z,relro -Wl,-z,now. faster and more secure initial startup