Feature: indirect branch tracking

[ysbaddaden]

Adds support for indirect branch tracking for X86[_64] (CET) and AArch64 targets through the following compile time flags (taken from gcc/clang/rust):

• -Dcf-protection=branch (or =return or =full) for X86
• -Dbranch-protection=bti for AArch64

These flags are automatically set for OpenBSD, that enforces IBT or BTI on all user land applications. The patch also removes the -Wl-znobtcfi linker option since we don't need to disable it anymore.

OpenBSD is the only OS I know to support and enforce IBT or BTI in user land. Linux for example only supports it for kernel code (for the time being). I manually tested IBT in an OpenBSD VM on x86_64 with a supported CPU (Intel Raptor Lake). I can compile & recompile crystal as well as run gmake std_spec without running into IBT issues 👍

Notes:

• I expected to have to add the ASM instructions to the fiber context switch ASM... but messing with the stack pointer isn't considered as a conditional jump apparently 🤷
• I'm using the genius idea from @straight-shoota that we can pass -Dkey=value then test for flag?("key=value") and it just worked 😲
• I can't test BTI on AArch64: I have no hardware and there are no bindings for the aarch64-unknown-openbsd target; there are little reasons it wouldn't work though;
• I added support for shadow stack (SHSTK) on X86 (-Dcf-protection=return). I'm not sure we really support it though, since fibers are messing with the stacks?

closes #13665
follow up to #15118 itself a followup of #15115