Add `lto` option to profiles.

Closes #759.

I'm not sure if I did this right!
Oh dear you are indeed correct! I think we'll need some special logic around this regardless because any non-root dependency will need to force not passing what the profile says in the dependency's manifest.