Allow enabling control flow guard in Windows build

[zooba]

BPO	44381
Nosy	@pfmoore, @tjguk, @zware, @zooba, @miss-islington, @neonene
PRs	bpo-44381: Windows build now allows enabling control flow guard #26645 [3.10] bpo-44381: Windows build now allows enabling control flow guard (GH-26645) #26681 [3.9] bpo-44381: Windows build now allows enabling control flow guard (GH-26645) #26682

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/zooba'
closed_at = <Date 2021-06-11.21:39:25.558>
created_at = <Date 2021-06-10.17:07:15.163>
labels = ['type-security', '3.8', '3.9', '3.10', '3.11', 'build', 'OS-windows']
title = 'Allow enabling control flow guard in Windows build'
updated_at = <Date 2021-08-25.19:34:26.981>
user = 'https://github.com/zooba'

bugs.python.org fields:

activity = <Date 2021-08-25.19:34:26.981>
actor = 'steve.dower'
assignee = 'steve.dower'
closed = True
closed_date = <Date 2021-06-11.21:39:25.558>
closer = 'steve.dower'
components = ['Build', 'Windows']
creation = <Date 2021-06-10.17:07:15.163>
creator = 'steve.dower'
dependencies = []
files = []
hgrepos = []
issue_num = 44381
keywords = ['patch']
message_count = 7.0
messages = ['395556', '395557', '395661', '395662', '395663', '400281', '400294']
nosy_count = 6.0
nosy_names = ['paul.moore', 'tim.golden', 'zach.ware', 'steve.dower', 'miss-islington', 'neonene']
pr_nums = ['26645', '26681', '26682']
priority = 'normal'
resolution = 'fixed'
stage = 'resolved'
status = 'closed'
superseder = None
type = 'security'
url = 'https://bugs.python.org/issue44381'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10', 'Python 3.11']

[zooba]

Currently we don't enable CFG (which is runtime protection against code injection into tables), because it likely has a performance impact and the kind of attack is outside our scope.

However, we should make it easier to build CPython with CFG enabled, so that third-parties who do want to include it in their scope can do so.