The secp256k1 subtree is built without our hardening flags. They are on core_interface, and cmake/secp256k1.cmake passes the subtree only the sanitizer and APPEND_* flags, so unless the compiler enables them by default its objects miss FORTIFY, the stack protector, stack clash protection and control flow protection. On aarch64 Ubuntu 26.04 with GCC 15 this also costs the whole binary its control flow property: master's bitcoind has no AArch64 feature note, and the three secp256k1 objects are the only ones in the build tree without it.
This PR moves the flags back to a hardening_interface library, which core_interface links; the CMakeLists.txt change is a revert of 77e553ab6a plus one comment. cmake/secp256k1.cmake then passes them to the subtree the same way as sanitize_interface. With it, the same build shows AArch64 feature: BTI, PAC, GCS on bitcoind. It does not fix #30677 on its own: the depends libraries are still built without -fcf-protection, which #30685 tried to change.
