Hide CFI behind a global flag.

This CL ensures that the LOCAL_SANITIZE=cfi is not honored unless it
is enabled globally using ENABLE_CFI='true' first. This allows CFI to
be hidden behind a flag.

Bug: 30227045
Bug: 22033465
Test: m -j40 works and device boots
Test: cfi is correctly honored only when the global flag is set.
Change-Id: If4508ba448bd4260020483f9c11ee849bb419713