Use more defensive LDFLAGS append method

In Debian Trixie and older, `dpkg-buildflags --get LDFLAGS` returns something like `-Wl,-z-relro` and in Forky and newer it looks like `-Wl,-z-relro -fcf-protection`, so instead of relying on that `-Wl` and appending to the existing value, we can (and should) just add new `-Wl` values to the end, which _should_ be combined together correctly by the compiler/linker.

Author: tianon