perf: Always compile libxml2 and libxslt with '-O2 -g'

This is the default for those libraries, but we were overriding CFLAGS
in some cases.

Additionally, we need to compile with -U_FORTIFY_SOURCE to avoid
Ubuntu's convention of setting -D_FORTIFY_SOURCE=2 when -O2 is
set. This leads to problems when running precompiled libraries on
musl (see #2100 for details).

Closes #2022.

ext/nokogiri/extconf.rb

@@ -510,7 +510,7 @@ def configure
             sha256: dependencies["libiconv"]["sha256"]
           }]
 
-        cflags = [ENV["CFLAGS"], "-O2", "-g"].join(" ")
+        cflags = concat_flags(ENV["CFLAGS"], "-O2", "-U_FORTIFY_SOURCE", "-g")
 
         recipe.configure_options += [
           "CPPFLAGS=-Wall",
@@ -548,7 +548,7 @@ def configure
         sha256: dependencies["libxml2"]["sha256"]
       }]
 
-    cflags = ENV["CFLAGS"]
+    cflags = concat_flags(ENV["CFLAGS"], "-O2", "-U_FORTIFY_SOURCE", "-g")
 
     if zlib_recipe
       recipe.configure_options << "--with-zlib=#{zlib_recipe.path}"
@@ -581,6 +581,8 @@ def configure
         sha256: dependencies["libxslt"]["sha256"]
       }]
 
+    cflags = concat_flags(ENV["CFLAGS"], "-O2", "-U_FORTIFY_SOURCE", "-g")
+
     if darwin?
       recipe.configure_options += ["RANLIB=/usr/bin/ranlib", "AR=/usr/bin/ar"]
     end
@@ -590,6 +592,7 @@ def configure
       "--without-crypto",
       "--with-debug",
       "--with-libxml-prefix=#{sh_export_path(libxml2_recipe.path)}",
+      "CFLAGS=#{cflags}",
     ]
   end