build-sys: add -U_FORTIFY_SOURCE to $PYTHON_CFLAGS when necessary

This patch only adds one line, but moves python detection
after cflags detection, so the result of the latter can
be used in the former.

$PYTHON_CFLAGS usually includes -D_FORTIFY_SOURCE, which will generate
a warning when compiling without optimization. Avoid by undefining
_FORTIFY_SOURCE.