toolchain: add fortify-headers, enable FORTIFY_SOURCE by default