build: add hardened builds with PIE (ASLR) support