CMakeLists.txt: add -fno-pie to prevent link failure on hardened systems