This is the GNAT part of the patch that adds the strub attribute for
function and variable types, command-line options, passes and
adjustments to implement it, documentation, and tests.

Besides documentation, the bulk of the patch adds strub(callable) to
subprograms that the compiler may call implicitly.  The reason for
that is that, in -fstrub=strict mode, a context that requires stack
scrubbing can only call subprograms that also perform stack scrubbing,
or that are declared safe to call from strub contexts, i.e.,
strub-callable.  Subprograms that may be implicitly called, and that
are safe to call (i.e., that won't leave on the stack caller-supplied
data that ought to be scrubbed), should thus be marked with this
pragma, so that they don't prevent units from compiling with
-fstrub=strict.

Tested on x86_64-pc-linux-gnu, committed on trunk

gcc/ada/

	* doc/gnat_rm.rst: Add...
	* doc/gnat_rm/security_hardening_features.rst: New.
	* doc/gnat_rm/about_this_guide.rst: Link to new chapter.
	* gnat_rm.texi: Regenerate.
	* gcc-interface/utils.c (handle_strub_attribute): New.
	(gnat_internal_attribute_table): Add strub.
	* libgnat/a-except.adb: Make Rcheck_CE_* strub-callable.
	* libgnat/a-except.ads (Raise_Exception): Likewise.
	(Raise_Exception_Always): Likewise.
	* libgnat/s-arit128.ads (Multiply_With_Ovflo_Check128):
	Likewise.
	* libgnat/s-arit64.ads (Multiply_With_Ovflo_Check64):
	Likewise.
	* libgnat/s-secsta.ads (SS_Allocate, SS_Mark, SS_Release):
	Likewise.