hardened-config: ensure STRICT_KERNEL_RWX

This is y in the default config, but enable it explicitly here to catch
situations where it has been disabled (explicitly or implicitly).