Use hardening option to add only hardening flags

Compiler flags that enable warnings were hidden behind the 'hardening'
option. This was a direct port of the previous autoconf config, but it
probably makes sense to always show them as they have no effect on
compiler's output (unlike hardening flags which distributors might want
to alter or disable completely).

Also remove -fwrapv (which is enabled by -fno-strict-overflow) and fix
all new warnings we've added (like VLAs in libgcrypt code, so it should
now be buildable with MSVC in case anyone wishes to do it).