chore(build): add hardening flags to default qTox builds

Re: #3452

qtox.pro

@@ -44,6 +44,20 @@ CONFIG   += link_pkgconfig
 # undocumented, but just works™
 CONFIG   += silent
 
+
+# Hardening flags (ASLR, warnings, etc)
+# TODO: add `-Werror` to hardening flags once all warnings are fixed
+QMAKE_CXXFLAGS += -fstack-protector-all \
+                  -fPIE \
+                  -Wstack-protector \
+                  -Wstrict-overflow \
+                  -Wstrict-aliasing \
+                  --param ssp-buffer-size=1
+# osx cannot into security (build on it fails with those enabled)
+!macx {
+    QMAKE_LFLAGS += -Wl,-z,now -Wl,-z,relro
+}
+
 # needed, since `rtti_off` doesn't work
 QMAKE_CXXFLAGS += -fno-rtti
 QMAKE_RESOURCE_FLAGS += -compress 9 -threshold 0