chore(windows): use /CETCOMPAT

Per @randomascii's tweet thread starting at https://twitter.com/BruceDawson0xB/status/1692295226042532192:

PSA: Enable /CETCOMPAT. Enable it in your exes and DLLs for improved security. Enable it in your DLLs that are distributed so that CET compatible processes can better use your DLLs.

https://learn.microsoft.com/en-us/cpp/build/reference/cetcompat?view=msvc-170

More details: CET is Control-flow Enforcement Technology. It tells modern CPUs to maintain a shadow stack of just return addresses, which makes stack smashes more difficult to exploit. Enabling this makes your processes more secure.

Windows has various "heuristics" (hacks) to try to "handle" CET failures. I guess they work sometimes. Other times they just hide the problems until the shadow stack overflows. Ask me how I know (hint: Chrome crashes caused by injected third-party code)

Setting /CETCOMPAT on DLLs lets Windows be stricter about how it handles violations. That's a good thing. So do it.

https://security.googleblog.com/2021/05/enabling-hardware-enforced-stack.html