Use general hardening flag toggle lists

The following parameters are now available:

  * hardeningDisable
    To disable specific hardening flags
  * hardeningEnable
    To enable specific hardening flags

Only the cc-wrapper supports this right now, but these may be reused by
other wrappers, builders or setup hooks.

cc-wrapper supports the following flags:

  * fortify
  * stackprotector
  * pie (disabled by default)
  * pic
  * strictoverflow
  * format
  * relro
  * bindnow

pkgs/tools/graphics/graphviz/2.0.nix

@@ -14,8 +14,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [pkgconfig xlibsWrapper libpng libjpeg expat libXaw yacc libtool fontconfig pango gd];
 
-  hardening_format = false;
-  hardening_fortify = false;
+  hardeningDisable = [ "format" "fortify" ];
 
   configureFlags =
     [ "--with-pngincludedir=${libpng}/include"

pkgs/tools/graphics/graphviz/2.32.nix

@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
     ]
     ++ stdenv.lib.optional (xorg == null) "--without-x";
 
-  hardening_fortify = false;
+  hardeningDisable = [ "fortify" ];
 
   preBuild = ''
     sed -e 's@am__append_5 *=.*@am_append_5 =@' -i lib/gvc/Makefile

pkgs/tools/graphics/graphviz/default.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
     sha256 = "17l5czpvv5ilmg17frg0w4qwf89jzh2aglm9fgx0l0aakn6j7al1";
   };
 
-  hardening_fortify = false;
+  hardeningDisable = [ "fortify" ];
 
   patches =
     [ ./0001-vimdot-lookup-vim-in-PATH.patch