use upstream CC_EXTRA_OPTS and LD_EXTRA_OPTS environment variables to pass hardening flags