prevent user CFLAGS overrides from exposing executable stack