BUILD: make -Werror optional

-Werror can break the build in so many ways that it
should only be used for development or if it's a specific
-Werror=foo flag.
BUILD: don't overwrite env ldflags and make as-needed optional
BUILD: reorder flags

This enables environment overrides without the need
for patching such as -fno-visibility=hidden.