Hide CFI behind a global flag.

This CL ensures that locally enabling CFI in a .bp file is not honored
unless it is enabled globally using ENABLE_CFI=true first, effectively
hiding it behind a flag.

Bug: 30227045
Bug: 22033465
Test: m -j40 works and device boots
Test: cfi is correctly honored only when the global flag is set.
Change-Id: Id026302e7f714b90a9e2c996f7a9314f534f90c2