Don't override the user's FLAGS

Fedora for instance sets -fstack-protector-strong
but we override that with -fstack-protector, which is less secure

Ideally we never touch CFLAGS, CXXFLAGS and the like but fixing
that is an exercise left for the reader.