build-sys: use _FORTIFY_SOURCE only if optimizing

Rather then force the user to undefine _FORTIFY_SOURCE,
don't define it in the first place if it cannot be used.

I'm assuming that -O* can only be sensibly specified in $CFLAGS.
nspawn: add --version