Fix arch-specific hardening_check ignore flags

hardening-check tests both CET (x86-only) and branch protection
(arm64-only). Pass the ignore flag for whichever doesn't apply to the
build arch so the test passes on all supported architectures.

CMakeLists.txt

@@ -206,9 +206,18 @@ endif()
 if(NOT CMAKE_CROSSCOMPILING)
   find_program(HARDENING_CHECK hardening-check)
   if(HARDENING_CHECK)
-    add_test(NAME hardening_check
+    # Control flow integrity (CET) is x86-only and branch protection (PAC/BTI)
-             COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}>
+    # is arm64-only, so ignore whichever doesn't apply.
-                     --nofortify --nostackprotector)
+    if(CMAKE_SYSTEM_PROCESSOR STREQUAL aarch64 OR CMAKE_SYSTEM_PROCESSOR
+                                                  STREQUAL arm64)
+      set(hardening_check_arch_flags --nocfprotection)
+    else()
+      set(hardening_check_arch_flags --nobranchprotection)
+    endif()
+    add_test(
+      NAME hardening_check
+      COMMAND ${HARDENING_CHECK} $<TARGET_FILE:${PROJECT_NAME}> --nofortify
+              --nostackprotector ${hardening_check_arch_flags})
   endif()
 endif()