debian: add hardening flags

(hopefully this actually does something)

closes #37
debian: update "recommended" hwdec drivers
debian: enable cdda
debian: target Jessie, Wheezy, Utopic, and Trusty

this means we can enable libopus
unfortunately, debian stable still has neither harfbuzz nor sdl2

closes #31