Guard --nobranchprotection behind a version check

Older versions of hardening-check (as shipped by some Ubuntu releases)
don't support --nobranchprotection and error out. Probe --help at
configure time and only add the flag when it's available; old versions
that lack the flag also don't check for branch protection, so omitting
it is safe.

CMakeLists.txt

@@ -212,7 +212,17 @@ if(NOT CMAKE_CROSSCOMPILING)
                                                   STREQUAL arm64)
       set(hardening_check_arch_flags --nocfprotection)
     else()
-      set(hardening_check_arch_flags --nobranchprotection)
+      # --nobranchprotection was added in a newer version of hardening-check;
+      # older versions don't check for it either, so omitting the flag is safe.
+      execute_process(
+        COMMAND ${HARDENING_CHECK} --help
+        OUTPUT_VARIABLE _hardening_check_help
+        ERROR_VARIABLE _hardening_check_help)
+      if(_hardening_check_help MATCHES "nobranchprotection")
+        set(hardening_check_arch_flags --nobranchprotection)
+      else()
+        set(hardening_check_arch_flags "")
+      endif()
     endif()
     add_test(
       NAME hardening_check