build: disable unsafe optimizations

Compile at -O2 and disable optimizations that trigger gcc bugs.

Some people still reported mksnapshot crashes after commit b40f813b ("build: fix
spurious mksnapshot crashes for good" - so much for that).

Average performance of the -O2 binary is on par with the -O3 binary. Variance
on the http_simple bytes/8 benchmark appears to be slightly greater but small
enough that the possibly of it being noise cannot be excluded.

The new binary very slightly but consistently outperforms the -O3 binary (by
about 0.5%) on the mostly CPU-bound bytes/102400 benchmark. That could be an
artifact of the system I benchmarked it on, a Core 2 Duo with a puny 32 kB of
L1 instruction cache. The smaller binary seems to play nicer with the cache.