[safestack] add -msafestack to cc1as, which marks the object as requiring safestack