use debian best-practices for gcc hardening