OpenSSF gold badge: apply hardening fixes from #1241 without enabling hardening itself

[mgovers]

Relates to #1241 .

In #1241 , a number of fixes were applied. This PR cherry-picks those fixes without actually enabling hardening itself. This enables safer code without enforcing things that are still TBD.

[figueroa1395]

Can you rename the PR? We already have the silver badge, perhaps we can name name this one gold badge, since this is needed for that milestone.

Besides this, no more comments from me. LGTM.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.2% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[TonyXiang8787]

Hi @mgovers, @figueroa1395,

I took out this PR out of merge queue because I still have some questions.

We have indeed some decisions to make about whether and how enable hardening build flags for release distribution.

But we can enable harnding flags in development cmake presets right?. That should check in the CI?

[mgovers]

But we can enable harnding flags in development cmake presets right?. That should check in the CI?

I think so, but i'd consider that a follow-up. #1241 has been open for so long that the fixes (which are actual cases of UB) should not be delayed any longer. IMO, we should scope out the other choices to a separate PR (maybe we can decide on the exact form on thursday)