958016: use rpm %{optflags} and _hardended_build

Use our CFLAGS only if not set in the env, so we default
to the CFLAGS rpm sets.
Merge pull request #897 from candlepin/alikins/958016_PIE_FORTIFY

958016: use rpm %{optflags} and _hardended_build