Combine into hardened-glibc.
Document why we don't use --disable-werror directly.
https://www.gnu.org/software/libc/manual/html_node/Configuring-and-compiling.html
By default, the GNU C Library is built with -Werror. If you wish
to build without this option (for example, if building with a
newer version of GCC than this version of the GNU C Library was
tested with, so new warnings cause the build with -Werror to fail),
you can configure with --disable-werror.
This is a backport of core#27326
Depends on D15327