changelog: use dpkg-buildflags and properly enable hardening

No match.