Pass the guard flags to the linker

/guard:ehcont was a compile option only. The compiler emits the
per-object EH continuation metadata, but the linker only collects it
into the load config directory when it is told to as well, so the
shipped driver carried none of it.

dumpbin /loadconfig on the driver, before and after:

  Guard Flags                 00000100  ->  00400500
  Guard EH continuation table 00000000  ->  0000000140013370
  Guard EH continuation count        0  ->  1C
  Guard CF function table     00000000  ->  00000001400133E0
  Guard CF function count            0  ->  2

00400500 is CF_INSTRUMENTED plus CF_FUNCTION_TABLE_PRESENT plus
EH_CONTINUATION_TABLE_PRESENT, where before only CF_INSTRUMENTED was
set with both tables empty. So the link flag alone was enough and
/guard:cf was not needed to get the table emitted.

Note this does not turn Control Flow Guard on. /guard:cf is still
absent at compile time, the CF function table has two entries rather
than one per address-taken function, and the guard(nocf) annotations in
msrmrs.cpp and natives_impl_windows.cpp remain inert. That is a
separate decision from the missing link flag and is left alone here.

Only the link changed, but the load config feeds /INTEGRITYCHECK
signing, so the driver was rebuilt signed, the installed package
swapped, and the test module run against it: ioctl_test_callback and
ioctl_test both succeed, PawnIOUtil exits 0, and the import list is
still only ntoskrnl.exe, HAL.dll and ksecdd.sys.