Move the libc++ hardening to be part of libcxx_feature (#6607)

This also switches it to only apply to C++ compiles rather than all
compiles.

bazel/cc_toolchains/cc_toolchain_cpp_features.bzl

@@ -178,6 +178,20 @@ clang_warnings_feature = feature(
     )],
 )
 
+# Libc++ HARDENING_MODE has 4 possible values:
+# https://libcxx.llvm.org/Hardening.html#notes-for-users
+#
+# Do not enable DEBUG hardening mode, even for -c dbg, because its performance
+# impact on llvm-symbolizer is too severe -- this flag results in symbolization
+# becoming quadratic in the number of debug symbols, in practice meaning it
+# never completes.
+_libcpp_debug_flags = [
+    "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
+]
+_libcpp_release_flags = [
+    "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_FAST",
+]
+
 libcxx_feature = feature(
     name = "libcxx",
     enabled = True,
@@ -192,6 +206,16 @@ libcxx_feature = feature(
                 with_feature_set(not_features = ["windows_target"]),
             ],
         ),
+        flag_set(
+            actions = all_cpp_compile_actions,
+            flag_groups = [flag_group(flags = _libcpp_debug_flags)],
+            with_features = [with_feature_set(not_features = ["opt"])],
+        ),
+        flag_set(
+            actions = all_cpp_compile_actions,
+            flag_groups = [flag_group(flags = _libcpp_release_flags)],
+            with_features = [with_feature_set(features = ["opt"])],
+        ),
         flag_set(
             actions = all_link_actions,
             flag_groups = [flag_group(flags = [