Merge bitcoin#30438: guix: (explicitly) build Linux GCC with `--enabl…

…e-cet`

89bf11b guix: build Linux GCC with --enable-cet (fanquake)

Pull request description:

  Similar to bitcoin#29695, and in the same vein of explicitly configuring hardening options in our release toolchain.

  See https://gcc.gnu.org/install/configure.html:

  >` --enable-cet`

  > Enable building target run-time libraries with control-flow instrumentation, see `-fcf-protection option`. When --enable-cet is specified target libraries are configured to add `-fcf-protection` and, if needed, other target specific options to a set of building options.

  > `--enable-cet=auto` is default. CET is enabled on Linux/x86 if target binutils supports Intel CET instructions and disabled otherwise. In this case, the target libraries are configured to get additional `-fcf-protection` option.

ACKs for top commit:
  TheCharlatan:
    ACK 89bf11b

Tree-SHA512: 772d8529713a31e5db42be4e053582bb9ba6f26079ae136c6bf8303c4992a90d61159dbb0fde7a4b4cb7b4bf5024d5397a78004e6188b36e1c36dd5e5cdc49ad

contrib/guix/manifest.scm

@@ -434,6 +434,7 @@ inspecting signatures in Mach-O binaries.")
                   "--enable-default-ssp=yes",
                   "--enable-default-pie=yes",
                   "--enable-standard-branch-protection=yes",
+                  "--enable-cet=yes",
                   building-on)))
         ((#:phases phases)
           `(modify-phases ,phases