move linker flags from compiler_flags to linker_flags; fix option syntax

"-Wl,-z,-relro,-z,now" was in compiler_flags, which is not very useful
because compiler_flags are not passed to the compilation driver for
link commands.

"-z -relro" is not even a valid linker flag set because of the
spurious leading dash on "relro":
$ gold -z -relro gold: -relro:
unknown -z option

--
Change-Id: Ic987312b7dec5cc68e7195b5ea88945653a93200
Reviewed-on: https://cr.bazel.build/7570
PiperOrigin-RevId: 141282978
MOS_MIGRATED_REVID=141282978
diff --git a/tools/cpp/cc_configure.bzl b/tools/cpp/cc_configure.bzl
index 330a068..eb34427 100644
--- a/tools/cpp/cc_configure.bzl
+++ b/tools/cpp/cc_configure.bzl
@@ -214,7 +214,11 @@
           "-lstdc++",
           "-lm",  # Some systems expect -lm in addition to -lstdc++
           # Anticipated future default.
-      ] + _add_option_if_supported(repository_ctx, cc, "-Wl,-no-as-needed") + (
+      ] + _add_option_if_supported(
+          repository_ctx, cc, "-Wl,-no-as-needed"
+      ) + _add_option_if_supported(
+          repository_ctx, cc, "-Wl,-z,relro,-z,now"
+      ) + (
           [
               "-undefined",
               "dynamic_lookup",
@@ -231,7 +235,8 @@
               # Gold linker only? Can we enable this by default?
               # "-Wl,--warn-execstack",
               # "-Wl,--detect-odr-violations"
-          ]),
+          ]
+      ),
       "ar_flag": ["-static", "-s", "-o"] if darwin else [],
       "cxx_builtin_include_directory": _get_cxx_inc_directories(repository_ctx, cc),
       "objcopy_embed_flag": ["-I", "binary"],
@@ -256,12 +261,11 @@
           "-Wall",
           # Enable a few more warnings that aren't part of -Wall.
       ] + (["-Wthread-safety", "-Wself-assign"] if darwin else [
-          # Disable some that are problematic.
-          "-Wl,-z,-relro,-z,now",
           "-B" + str(repository_ctx.path(cc).dirname),
           # Always have -B/usr/bin, see https://github.com/bazelbuild/bazel/issues/760.
           "-B/usr/bin",
       ]) + (
+          # Disable problematic warnings.
           _add_option_if_supported(repository_ctx, cc, "-Wunused-but-set-parameter") +
           # has false positives
           _add_option_if_supported(repository_ctx, cc, "-Wno-free-nonheap-object") +