Harden native Linux/macOS DLL/so/syslib compilation

[Kielek]

I think I've found some information about how to enable equivalents for CMake for Linux and macOS, but I'll do that in a separate PR.

Originally posted by @martincostello in #4768 (comment)

[martincostello]

Output from BinSkim for the v1.13.0 release's builds:

Linux

glibc

> clear && .\binskim.exe analyze *.so --recurse true --kind "Fail"
Analyzing...
THREADS: 20
C:\Users\marti\Downloads\zero-code-prod\opentelemetry-dotnet-instrumentation-linux-glibc-arm64\linux-arm64\OpenTelemetry.AutoInstrumentation.Native.so: error BA3011: The BIND_NOW flag is missing from this binary, so relocation sections in 'OpenTelemetry.AutoInstrumentation.Native.so' will not be marked as read only after the binary is loaded.  An attacker can overwrite these to redirect control flow.  Ensure you are compiling with the compiler flags '-Wl,-z,now' to address this.
C:\Users\marti\Downloads\zero-code-prod\opentelemetry-dotnet-instrumentation-linux-glibc-arm64\linux-arm64\OpenTelemetry.AutoInstrumentation.Native.so: error BA3031: 'OpenTelemetry.AutoInstrumentation.Native.so' was compiled using Clang but without the SafeStack instrumentation pass, which should be used to mitigate the risk of stack-based buffer overflows. To enable SafeStack, pass '-fsanitize=safe-stack' flag to both compile and link command lines.
C:\Users\marti\Downloads\zero-code-prod\opentelemetry-dotnet-instrumentation-linux-glibc-x64\linux-x64\OpenTelemetry.AutoInstrumentation.Native.so: error BA3011: The BIND_NOW flag is missing from this binary, so relocation sections in 'OpenTelemetry.AutoInstrumentation.Native.so' will not be marked as read only after the binary is loaded.  An attacker can overwrite these to redirect control flow.  Ensure you are compiling with the compiler flags '-Wl,-z,now' to address this.
C:\Users\marti\Downloads\zero-code-prod\opentelemetry-dotnet-instrumentation-linux-glibc-x64\linux-x64\OpenTelemetry.AutoInstrumentation.Native.so: error BA3031: 'OpenTelemetry.AutoInstrumentation.Native.so' was compiled using Clang but without the SafeStack instrumentation pass, which should be used to mitigate the risk of stack-based buffer overflows. To enable SafeStack, pass '-fsanitize=safe-stack' flag to both compile and link command lines.

Done. 2 files scanned.
Analysis completed successfully.

One or more rules was disabled for an analysis target, as it was determined not to be applicable to it (this is a common condition). Include 'NotApplicable' on an explicit '--kind' command-line argument (e.g., '--kind "Fail;NotApplicable"') for more information.

musl

Scan fails due to microsoft/binskim#1136.

macOS

The macOS .dylib file reports no issues, but it might be that it isn't a supported format or has less analysis for those types of files.