win,build: add option to enable cfg

[huseyinacacak-janea]

This adds an option to vcbuild.bat to compile with CFG (Control Flow Guard).

CFG is a programming or security concept used to ensure that the execution of a program follows its intended flow and prevents unauthorized or unintended behavior. It is often used to detect and mitigate attacks that exploit vulnerabilities, such as control flow hijacking, which occurs when an attacker manipulates the program’s control flow to execute malicious code.

• CFG validates that indirect calls (e.g., calls via function pointers) and jumps go to legitimate, pre-determined destinations within the program.
• When the application is compiled with CFG enabled, the compiler generates metadata about the valid control flow targets.
• At runtime, Windows uses this metadata to verify the destination of indirect calls or jumps before allowing them.

More information about the CFG can be found at https://learn.microsoft.com/en-us/windows/win32/secbp/control-flow-guard

Fixes: #42100

[nodejs-github-bot]

Review requested:

• @nodejs/gyp

[jasnell]

LGTM but would be worthwhile to expand on the motivation a bit in the PR or the commit message for folks unfamiliar with cfg

[richardlau]

I would rather a more descriptive name than "cfg" was used in common.gypi and configure (I'm less concerned with vcbuild.bat).

Are there any plans to enable this by default in the future?

[huseyinacacak-janea]

Are there any plans to enable this by default in the future?

No plan yet. CFG adds extra checks to the code to increase security. Therefore, these checks have a runtime cost in certain situations. Instead of enabling it by default, it might be enabled and released as a separate executable.

[huseyinacacak-janea]

LGTM but would be worthwhile to expand on the motivation a bit in the PR or the commit message for folks unfamiliar with cfg

I've updated the PR description to give more information about CFG.