mesa: use grsec at build time, override at run time

This is needed for grsecurity kernels to be able to build stuff (e.g. pango).
With grsec the libGL is slower, but we don't care much at build time,
so we can share binaries among grsec and nogrsec.

This adds 2-3 MB to nogrsec closures that use mesa drivers (libGL is doubled).