Blacklist code for CFI.

Adds the -fsanitize-blacklist option for CFI, using the built in
blacklist at external/compiler-rt/lib/cfi/cfi_blacklist.txt.

Also refactors the CFI cflags and ldflags into ../soong/cc/makevars.go
to ensure they're consistent across Soong and make projects.

Bug: 30227045
Test: ENABLE_CFI=true m -j40 builds and boots.
Test: The blacklist prevents runtime errors that otherwise occur.
Change-Id: I0c2801ed459a3b9adeb37daff3ca212564801259