Add pass-cppflags.patch to make all hardening work.

The upstream build system didn't use $(CPPFLAGS) in the build, causing
the fortify source functions hardening feature to remain disabled. This
patch fixes that.