remove usage of absolute rpaths

This is a significant security issue as it adds a hidden library path
based on the location of the build directory. It is *always* wrong in an
installed package, and can be leveraged by an privileged user to inject
libraries into a binary called by another user or even root.

Closes #11746

This is a step towards fixing #11747 but is only a partial solution.