Similar to #29695, and in the same vein of explicitly configuring
hardening options in our release toolchain.
See https://gcc.gnu.org/install/configure.html:
Enable building target run-time libraries with control-flow instrumentation,
see -fcf-protection option. When --enable-cet is specified target
libraries are configured to add -fcf-protection and, if needed,
other target specific options to a set of building options.
--enable-cet=auto is default. CET is enabled on Linux/x86 if target
binutils supports Intel CET instructions and disabled otherwise.
In this case, the target libraries are configured to get additional
-fcf-protection option.
This is a backport of core#30438 and core#31121
Depends on D20551