Use general hardening flag toggle lists

The following parameters are now available:

  * hardeningDisable
    To disable specific hardening flags
  * hardeningEnable
    To enable specific hardening flags

Only the cc-wrapper supports this right now, but these may be reused by
other wrappers, builders or setup hooks.

cc-wrapper supports the following flags:

  * fortify
  * stackprotector
  * pie (disabled by default)
  * pic
  * strictoverflow
  * format
  * relro
  * bindnow

pkgs/development/tools/analysis/cccc/default.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation {
     sha256 = "1gsdzzisrk95kajs3gfxks3bjvfd9g680fin6a9pjrism2lyrcr7";
   };
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   patches = [ ./cccc.patch ];
 

pkgs/development/tools/analysis/radare/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     sha256 = "1qdrmcnzfvfvqb27c7pknwm8jl2hqa6c4l66wzyddwlb8yjm46hd";
   };
 
-  hardening_format = false;
+  hardeningDisable = [ "format" ];
 
   buildInputs = [pkgconfig readline libusb perl]
     ++ optional useX11 [gtkdialog vte gtk]

pkgs/development/tools/analysis/valgrind/default.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "doc" ];
 
-  hardening_stackprotector = false;
+  hardeningDisable = [ "stackprotector" ];
 
   # Perl is needed for `cg_annotate'.
   # GDB is needed to provide a sane default for `--db-command'.