kbd: add de-latin1-nodeadkeys layout
bison: depends on m4
stage1: add kbd
add relro LDFLAGS to butch defaults

this should give additional security (at least for dynamically
linked apps).
since the musl dynlinker does only non-lazy relocation anyway,
the "full" protection may be unnecessary, but one can never have
enough security...

http://tk-blog.blogspot.ch/2009/02/relro-not-so-well-known-memory.html
http://isisblogs.poly.edu/2011/06/01/relro-relocation-read-only/
dropbear: build with scp binary

in the same turn, use user-supplied cflags and install into bin
rather than into sbin.
add util to check for missing relro hardening
butch default cflags: add -Wa,--noexecstack and clean up
dropbear: disable wtmp/utmp
dropbear: disable lastlog and make a symlink to ssh

also disable syslog support since dropbear is intended to be started
via "sv u sshd" (it takes the role of openssh's sshd), and runit takes
care of the stdout output and writes it into the log itself.

without the ssh->dbclient symlink, git does not work...
sshd service: fall back to dropbear in case openssh is not available
sshd service: with dropbear syslog disabled, -E is default

instead of swallowing the option silently, it fails.
make most of the stage1 + core packages use custom cflags

addressing #91
add util to find static and dynamic linked binaries