Introduce NOTSHLIBLDFLAGS, used to link executables only

[smcv]

This can be used for LDFLAGS that would be inappropriate for shared
libraries, such as the "-fPIE -pie" used to link position-independent
executables. PIEs make it more difficult to exploit various classes
of security vulnerability.

---

We use this in Debian, where the dpkg build system defines some standard distribution-wide CPPFLAGS (including -D_FORTIFY_SOURCE), CFLAGS (including -fPIE -O2) and LDFLAGS (including -pie), by running make with these definitions:

CFLAGS='$(filter-out -fPIE -pie,$(CFLAGS)) $(CPPFLAGS)'
NOTSHLIBCFLAGS='$(filter -fPIE -pie,$(CFLAGS))'
LDFLAGS='$(filter-out -fPIE -pie,$(LDFLAGS))'
NOTSHLIBLDFLAGS='$(filter -fPIE -pie,$(LDFLAGS))'

This results in executables being compiled with -fPIE and linked with -pie, while shared libraries (loadable modules) are still compiled with -fPIC and linked with -shared as intended.