add control flow integrity to clang production builds

See https://clang.readthedocs.io/en/latest/ControlFlowIntegrity/