Validate that ELF objects request a non-executable stack

[geofft]

Closes #1069.

[jjhelmus]

llvm/llvm-project#186004 will cause object files assembled with LLVM 22 to fail this check.
These could be post-processed with objcopy to add the section. Another option is to limit this check to only the ELF objects in the install directory or potentially just python and libpython.

[geofft]

Yeah, I also missed the distinction between executables/libraries which have the PT_GNU_STACK program headers, and intermediate objects that have the section but no program headers (at all). I'll make this check conditional on final objects (ET_EXEC or ET_DYN, I think), and we can defer checking .o files to later.

[jjhelmus]

LGTM. Should we validate this on other architectures before meting?

[geofft]

I was gonna pay attention to CI post-merge and then open a new PR to do -Wl,-z,noexecstack if there are any failures. Lemme know if that seems too risky :)

[jjhelmus]

Watching the post merge for failures is reasonable.
Merging. I will keep an eye out for failures. Thanks.

[jjhelmus]

riscv64 builds are failing verification.

python/install/lib/thread3.0.4/libtcl9thread3.0.4.so missing PT_GNU_STACK header (defaults to executable stack)

https://github.com/astral-sh/python-build-standalone/actions/runs/24349377629/job/71099408609

I'm taking a look

[jjhelmus]

Confirmed the missing GNU_STACK header in the riscv64 builds, mostly in Tcl/Tk related libraries, locally. This is not new, the header is missing in an older (20251010) release as well.

Adding in an explicit flag to avoid this should be done, if too much work this test can be skipped on the architecture. I'll prepare both after lunch.