Build: disable CFI when LTO is disabled

Clang CFI relies on link-time optimization, so disable CFI when
allow_posix_link_time_opt = false.
http://clang.llvm.org/docs/ControlFlowIntegrity.html

This was leading to linker errors on an official build with LTO disabled,
such as:
error: obj/native_client/src/shared/gio/libgio.a: no archive symbol table

R=dpranke@chromium.org

Review-Url: https://codereview.chromium.org/2406673002
Cr-Original-Commit-Position: refs/heads/master@{#424816}
Cr-Mirrored-From: https://chromium.googlesource.com/chromium/src
Cr-Mirrored-Commit: b2472ea7c13e04309fc6bf21c5c537071705e859

config/sanitizers/sanitizers.gni

@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 import("//build/config/chrome_build.gni")
+import("//build/toolchain/toolchain.gni")
 
 declare_args() {
   # Compile for Address Sanitizer to find memory bugs.
@@ -54,7 +55,7 @@ declare_args() {
   #
   # TODO(pcc): Remove this flag if/when CFI is enabled in all official builds.
   is_cfi = target_os == "linux" && !is_chromeos && target_cpu == "x64" &&
-           is_chrome_branded && is_official_build
+           is_chrome_branded && is_official_build && allow_posix_link_time_opt
 
   # Enable checks for bad casts: derived cast and unrelated cast.
   # TODO(krasin): remove this, when we're ready to add these checks by default.