Revert "Merge pull request #28557 from obsidiansystems/binutils-wrapper"

This reverts commit 0a944b345e, reversing
changes made to 61733ed6cc.

I dislike these massive stdenv changes with unclear motivation,
especially when they involve gratuitous mass renames like NIX_CC ->
NIX_BINUTILS. The previous such rename (NIX_GCC -> NIX_CC) caused
months of pain, so let's not do that again.

pkgs/build-support/cc-wrapper/add-hardening.sh

@@ -6,6 +6,7 @@ if [[ -v hardeningEnable[@] ]]; then
   hardeningFlags+=(${hardeningEnable[@]})
 fi
 hardeningCFlags=()
+hardeningLDFlags=()
 
 declare -A hardeningDisableMap
 
@@ -43,6 +44,7 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
           if [[ ! ("$*" =~ " -shared " || "$*" =~ " -static ") ]]; then
             if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling LDFlags -pie >&2; fi
             hardeningCFlags+=('-pie')
+            hardeningLDFlags+=('-pie')
           fi
           ;;
         pic)
@@ -57,6 +59,14 @@ if [[ -z "${hardeningDisableMap[all]:-}" ]]; then
           if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling format >&2; fi
           hardeningCFlags+=('-Wformat' '-Wformat-security' '-Werror=format-security')
           ;;
+        relro)
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling relro >&2; fi
+          hardeningLDFlags+=('-z' 'relro')
+          ;;
+        bindnow)
+          if [[ -n "${NIX_DEBUG:-}" ]]; then echo HARDENING: enabling bindnow >&2; fi
+          hardeningLDFlags+=('-z' 'now')
+          ;;
         *)
           # Ignore unsupported. Checked in Nix that at least *some*
           # tool supports each flag.