nmap: several fixes

- respect optcflags
- do not strip (optcflags has -s anyway, unless DEBUGBUILD is set)
- link against gnu-getopt to fix -O (os detection) flag recognition
  nmap -O -sV -sT -Pn scanme.nmap.org : "Unknown argument to -O."
iptables: put LDFLAGS into separate line