Makefile: move stack-protector availability out of Kconfig