Merge branch 'hardened-stdenv' into staging

Closes #12895

Amazing work by @globin & @fpletz getting hardened compiler flags by
enabled default on the whole package set

pkgs/development/tools/build-managers/gnumake/3.80/default.nix

@@ -2,12 +2,16 @@
 
 stdenv.mkDerivation {
   name = "gnumake-3.80";
+
   src = fetchurl {
     url = http://tarballs.nixos.org/make-3.80.tar.bz2;
     md5 = "0bbd1df101bc0294d440471e50feca71";
   };
+
   patches = [./log.patch];
 
+  hardeningDisable = [ "format" ];
+
   meta = {
     platforms = stdenv.lib.platforms.unix;
   };