Build hardening

[mayeut]

• Use hardening for building all tools & libraries
  This does not affect the wheels that are produced by end users as proposed in Enable hardening of binaries included in the wheels built for manylinux  #59 but mitigates potential security issues in the tools used by manylinux images as mentioned in CVE-2021-3177 #1005
• Always update system packages in the final step
  Since docker cache is used, system packages are not updated when cache is present. Always update them in the final step.

[mayeut]

@trishankatdatadog, @aws-taylor, @wallrj,

Any thoughts on this PR ?

[trishankatdatadog]

Good idea. What about all the other default flags?

[mayeut]

All other flags I can think of for security purposes do not work on those old distros:

-fPIE / -Wl,-pie
-fstack-clash-protection
-fcf-protection

[trishankatdatadog]

All other flags I can think of for security purposes do not work on those old distros:

Understood. If so, let's link to that document I sent, and comment on why we turned on only some flags and not others?