feat: Enable ubsan on bootstrap nodes.

[iphydf]

Not all sanitizers are enabled, but the cheap ones are, making the bootstrap node quite a bit more secure at a small runtime cost.

---

This change is 

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (89b6450) 71.74% compared to head (90f7496) 71.55%.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2472      +/-   ##
==========================================
- Coverage   71.74%   71.55%   -0.19%     
==========================================
  Files          75       75              
  Lines       25200    25200              
==========================================
- Hits        18079    18033      -46     
- Misses       7121     7167      +46     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Green-Sky]

cool. when the new gcc is more popular, we should look at `-fhardened' too.

[nurupo]

Commit message says "enable ubsan" (Undefined Behavior Sanitizer), yet there is no -fsanitize=undefined. Seems misleading.

[iphydf]

Commit message says "enable ubsan" (Undefined Behavior Sanitizer), yet there is no -fsanitize=undefined. Seems misleading.

https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html#available-checks

All checks I've enabled are part of ubsan, and most are part of -fsanitize=undefined, which is simply a short-hand for enabling a whole bunch of them at the same time.