Update our gcc nerfing.
    
    - Only nerf annobin, not -fstack-crash-protection.
    - Fix a conflict on /boot/efi directory permissions between -cdboot and the
      normal bootloader.
    
    Signed-off-by: Peter Jones <pjones@redhat.com>