Makefile: link with -z noexecstack --no-warn-rwx-segments