cmd/go: improper validation of cgo flags can lead to remote code execution at build time

[katiehockman]

The go command may execute arbitrary code at build time when cgo is in use. This may occur when running go get on a malicious package, or any other command that builds untrusted code.

This can be caused by a malicious gcc flags specified via a #cgo directive.

Thanks to Imre Rad for reporting this issue.

This issue is CVE-2020-28367.

[katiehockman]

Fixed by 062e0e5

Fixed by da7aa86 (https://golang.org/cl/267277)