changelog: use dpkg-buildflags and properly enable hardening