Force -fno-stack-protector on "boot block" that absolutely can't have

Force -fno-stack-protector on "boot block" that absolutely can't have
a stack protector (probably not even a -fstack-protector-strong) because
the bloat would render them unuseable.  This also means the system
compiler can now take on any more it wants, and all the pieces which
can't use the stack protector are properly marked.
ok kettenis