Only pass user flags to icu-config

Avoid passing hardening flags. Upstream commit also keeps system
libraries out of icu-config, though this doesn't specifically affect
Debian.