Setting hardening compiler flags is used in three places: default build,
static build and enterprise build — refactor it into a separate module.
Follow-up e6abe1c9
NO_CHANGELOG=refactoring
NO_DOC=refactoring
NO_TEST=refactoring
(cherry picked from commit dd51a2fa)