debian: enable hardening flags, except PIE. Enabling PIE currently results in the inability to build dynamic modules.