cc-wrapper, binutils-wrapper: add tests for hardening-flags-handling

[risicle]

Description of changes

This uses debian-devscripts' hardening-check for most checks, which only works on ELF systems and can only detect a limited subset of flags.

Tests mentioning "fortify3" depend on the fortify3 support currently in staging (#212498, #217394), but I've directed this at master to make it easier for people to test. Expect eval errors for those tests until this staging cycle makes it to master.

For me, this seems to work correctly on linux x86_64, with pkgsMusl, pkgsStatic and pkgsCross.aarch64-multiplatform behaving as expected.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 23.05 Release Notes (or backporting 22.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

[risicle]

@ofborg eval

[risicle]

Interesting things about this if reviewed now:

1. I'm not sure why nixpkgs-review is ignoring the broken=true flag for these cases. Does it ignore brokenness for newly-added packages?
2. On x86_64 linux at least, tests.hardeningFlags-clang.fortifyExplicitEnabledExecTest is failing - almost suggesting that clang only actually has FORTIFY_SOURCE=1 support on linux (!).

[bobby285271]

why nixpkgs-review is ignoring the broken=true flag

I just ran into similar issue in #223671 (comment) and wonder if --extra-nixpkgs-config '{ allowBroken = false; }' will help here.

[risicle]

(not actually going to merge this until we have a better idea about what the desired behaviour is...)

[risicle]

(rebased, adjusted expected results for current nixpkgs)