- add -O1 to make FORTIFY_SOURCE happy (eliminate compiler warnings)
- canonicalize CMAKE_CXX_FLAGS_DEBUG to avoid unnecessary recompilation

Both issues were introduced with f7fc3d3a