make: don't magically -D_FORTIFY_SOURCE=2

This is just annoying for development.  You want -O0 or -Og,
and consequently you get lots of warnings that are difficult to disable.

I believe hardening options are more of a responsibility/choice of the
caller, typically distributions have some general policies and pass the
flags (almost) uniformly to all packages.  I can't see any part of kresd
being so specific to warrant explicit hardening.