HBSD: enforce INVARIANTS if building secured host

If you really know what you're doing and you can specify
PAX_INSECURE_MODE to disable this enforcement

github-issue: #25
Signed-off-by: Oliver Pinter <oliver.pinter@hardenedbsd.org>