958016: use rpm %{optflags} and _hardended_build

Use our CFLAGS only if not set in the env, so we default
to the CFLAGS rpm sets.