Those two may work incorrectly together. Namely, ASAN may produce
false positives or false negatives. For details see
https://github.com/google/sanitizers/wiki/AddressSanitizer#faq

Make SECURITY_HARDENED disabled by default if WITH_ASAN=ON

Based on contribution by Eugene Kosov.