Only enable exec-shield when possible

Systems that support NX don't have this.