Enable CET shadow stack compatibility in apphost/singlefilehost by default

[elinor-fung]

Enable CET shadow stack compatibility in apphost/singlefilehost by default

• Build Windows x64 apphost and singlefilehost with /cetcompat (shared libraries are already being built with this flag)
• Allow disabling CET compat (clearing the DLL characteristics bit in the PE image) in HostWriter.CreateAppHost
• Add unit/integration tests

This change makes it so that a user's app will have CET compatibility enabled by default (for Windows x64). There will be a corresponding change on the SDK side such that it can be disabled with <CetCompat>false</CetCompat>.

cc @dotnet/appmodel @janvorli @mangod9

[dotnet-policy-service]

Tagging subscribers to this area: @vitek-karas, @agocke
See info in area-owners.md if you want to be subscribed.

[janvorli]

LGTM, thank you!

[mangod9]

Thanks for implementing this. We should keep an eye on CI, we had noticed that the CET specific CI was failing with new EH enabled, so wondering if that would affect a wider spectrum after this merges.

[AaronRobinsonMSFT]

[janvorli]

@elinor-fung please don't merge this change in yet. I was investigating a CET test leg failure yesterday and found a problem with the shadow stack and the new exception handling that needs to be addressed before this change gets in.

[janvorli]

@elinor-fung my CET fix is merged in, so please feel free to merge this in once the CI is green.

[elinor-fung]

Thanks, @janvorli!