- `-fcf-protection` to protect the targets of indirect jumps and
function returns.
- `-D_GLIBCXX_ASSERTIONS` for bounds-check assertions in the STL.
- `-fstack-clash-protection` to protect against stacks overwriting each
other.
- `-fstack-protector-strong` instead of `-fstack-protector-all` as it
apparently gives basically the same benefits at less slowdown.
These flags were taken from
https://developers.redhat.com/blog/2018/03/21/compiler-and-linker-flags-gcc/.