Use build_cflags when setting ASMFLAGS
    
    While the current implementation works on Fedora, on c9s/rhel
    the CFLAGS haven't been set at this point yet, so we are missing
    the -fcfprotection flag in ASMFLAGS. Using build_cflags avoids
    this ordering problem.
    
    Additionally, add -Wl,-z,cet-report=error to the libLLVM.so linker
    flags, so we can detect such issues earlier in the future.