Avoid blhc "CPPFLAGS missing" false positive.
We don't really need CPPFLAGS here (we don't use CC to compile anything) but this avoids a false positive in blhc, which in turns allows one to run blhc as part of CI, like we do on https://salsa.debian.org/apparmor-team/apparmor/pipelines.