cmd/go: allow -I= and -I$SYSROOT in cgo CFLAGS

Current checkFlags() didn't allow any not safe charactars in arguments.
In GCC "=" in arguments will be replaced with sysroot prefix, and used
by users to work with different SDK versions.

This CL allow to use "=" and $SYSROOT with -I argument.

Fixes #34449

Change-Id: I3d8b2b9d13251e454ea18e9d34a94b87c373c7b4
Reviewed-on: https://go-review.googlesource.com/c/go/+/196783
Run-TryBot: Jay Conrod <jayconrod@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Jay Conrod <jayconrod@google.com>

src/cmd/go/internal/work/security.go

@@ -280,6 +280,15 @@ Args:
 					continue Args
 				}
 
+				// Permit -I= /path, -I $SYSROOT.
+				if i+1 < len(list) && arg == "-I" {
+					if (strings.HasPrefix(list[i+1], "=") || strings.HasPrefix(list[i+1], "$SYSROOT")) &&
+						load.SafeArg(list[i+1][1:]) {
+						i++
+						continue Args
+					}
+				}
+
 				if i+1 < len(list) {
 					return fmt.Errorf("invalid flag in %s: %s %s (see https://golang.org/s/invalidflag)", source, arg, list[i+1])
 				}

src/cmd/go/internal/work/security_test.go

@@ -56,6 +56,9 @@ var goodCompilerFlags = [][]string{
 	{"-I", "."},
 	{"-I", "/etc/passwd"},
 	{"-I", "世界"},
+	{"-I", "=/usr/include/libxml2"},
+	{"-I", "dir"},
+	{"-I", "$SYSROOT/dir"},
 	{"-framework", "Chocolate"},
 	{"-x", "c"},
 	{"-v"},
@@ -83,6 +86,7 @@ var badCompilerFlags = [][]string{
 	{"-D", "-foo"},
 	{"-I", "@foo"},
 	{"-I", "-foo"},
+	{"-I", "=@obj"},
 	{"-framework", "-Caffeine"},
 	{"-framework", "@Home"},
 	{"-x", "--c"},