Older versions of hardening-check (as shipped by some Ubuntu releases)
don't support --nobranchprotection and error out. Probe --help at
configure time and only add the flag when it's available; old versions
that lack the flag also don't check for branch protection, so omitting
it is safe.
The Makefile generator does not create a rule for individual object files
when $<TARGET_OBJECTS:...> is used in DEPENDS of add_custom_command. Depending
on the target name instead establishes a proper target-level dependency.
hardening-check tests both CET (x86-only) and branch protection
(arm64-only). Pass the ignore flag for whichever doesn't apply to the
build arch so the test passes on all supported architectures.
andrew
