Build system improvements

Various cleanups and simplifications of the makefiles, plus:

- an additional 'make RELEASE_BUILD=1' mode which switches on
  optimisation and -D_FORTIFY_SOURCE=2, and switches off -Werror
- Use RELEASE_BUILD=1 in rpm and deb packaging
- Build with PIE and full RELRO by default
- Add CFLAGS_APPEND to append options instead of overriding CFLAGS