toolchain: only use fortify-headers for musl