build: add -Wa,-mbranches-within-32B-boundaries compiler flag

[johubertj]

Description of changes:

Add support for the -Wa,-mbranches-within-32B-boundaries compiler flag to reduce conditional branch alignment penalties on modern x86 microarchitectures. This flag was recommended to be added to s2n-tls by researchers (Annika Wilde, Samira Briongos, Claudio Soriente, and Ghassan Karame) from Ruhr University Bochum.

This PR introduces:

• A feature probe S2N_BRANCH_ALIGN to detect whether the current compiler supports the flag.
• Conditional application of the flag based on the probe result and platform.
• Skips applying the flag for fuzz builds to avoid Clang-related build failures.

Call-outs:

This change aligns with Intel's guidance to mitigate conditional branch alignment issues on modern x86 microarchitectures. See: Intel Mitigations for Jump Conditional Code Erratum (INTEL-841076)

Testing:

1. Performance Benchmarking
   Benchmarks were run locally on an x86_64 machine using:

cargo bench --bench handshake

Tested 5 handshake types, running each 3 times. First, I commented out the line that adds the compiler flag and recompiled. Then, I re-enabled the flag, recompiled, and ran the benchmarks again for comparison.

• handshake-server-auth
• handshake-mTLS
• handshake-resumption
• handshake-secp256r1

Result: No performance regression (based on execution time) was observed with the flag enabled vs disabled. Performance remained within normal variance range.

2. Compiler Compatibility
   To safely apply this flag:

• Added a feature probe that attempts to compile a minimal source file using the flag.
• If compilation succeeds, the flag is applied.
• The flag is not applied during fuzz builds (which use Clang), even if the probe passes.

3. Verified Compiler Flag Application (CMake + build.rs)

To confirm that the -Wa,-mbranches-within-32B-boundaries flag was applied on the Rust side (build.rs), I added CC_ENABLE_DEBUG_OUTPUT=1 and -vv to the asan-unit-tests CI job. This exposed the final compiler command in the logs.

Link to CI output showing flag

To confirm the flag is applied on the CMake side, I updated the build command in buildspec_mem.yml to use verbose mode (--verbose --clean-first). -Wa,-mbranches-within-32B-boundaries is on line 1326 of the following CodeBuild job:

s2nGeneralBatch:8a50d464-55dd-46b4-ab16-6a9ca1f8346c (line 1326)