The change to use ld and objcopy for resources
had some side-effects: it leaked a few symbols
and made our stack executable. We don't want that.

Use -z nonexecstack and --strip-all to avoid this.

Fixes: #4598