Merge bitcoin/bitcoin#30433: build: add standard branch-protection …

…to hardening flags for aarch64-linux

001b1cf build: use standard branch-protection for aarch64-linux (fanquake)

Pull request description:

  Use `-mbranch-protection=standard` when targetting `*aarch64-*-linux*`.
  Part of #24123, but this flag can already be used on a best effort basis.

  Note that this flag is also already used by default, in the toolchain, on various distros (i.e Fedora).

ACKs for top commit:
  hebasto:
    ACK 001b1cf.
  TheCharlatan:
    ACK 001b1cf

Tree-SHA512: 2d7ae60f59921a62d51139cb0fd5cecbed4f63266564b2623b7d160f5b0c2c42c78ef8aeff787f485eccc46a9ffd5da70023ec093df6add7c982e0d48a1601b5

CMakeLists.txt

@@ -506,7 +506,11 @@ if(ENABLE_HARDENING)
     endif()
 
     if(CMAKE_SYSTEM_PROCESSOR STREQUAL "aarch64" OR CMAKE_SYSTEM_PROCESSOR STREQUAL "arm64")
-      try_append_cxx_flags("-mbranch-protection=bti" TARGET hardening_interface SKIP_LINK)
+      if(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
+        try_append_cxx_flags("-mbranch-protection=bti" TARGET hardening_interface SKIP_LINK)
+      else()
+        try_append_cxx_flags("-mbranch-protection=standard" TARGET hardening_interface SKIP_LINK)
+      endif()
     endif()
 
     try_append_linker_flag("-Wl,--enable-reloc-section" TARGET hardening_interface)