ci: add debian hardening builds