chore: fix Windows CI build command and add security hardening

- Remove invalid GCC flags (/fPIC -shared) that MSVC silently ignored
- Fix output path from -o to /Fe notation (the DLL was not landing in dist/)
- Add /sdl /guard:cf /Qspectre /ZH:SHA_256 (compiler) and /DYNAMICBASE /NXCOMPAT /guard:cf /CETCOMPAT (linker)

Author: mceachen

.github/workflows/release.yaml

@@ -49,7 +49,7 @@ jobs:
         shell: bash
       - run: make sqlite-vec.h
       - run: mkdir dist
-      - run: cl.exe /fPIC -shared /W4 /Ivendor/ /O2 /LD sqlite-vec.c -o dist/vec0.dll
+      - run: cl.exe /W4 /sdl /guard:cf /Qspectre /ZH:SHA_256 /Ivendor/ /O2 /LD sqlite-vec.c /Fedist/vec0.dll /link /DYNAMICBASE /NXCOMPAT /guard:cf /CETCOMPAT
       - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: sqlite-vec-windows-x86_64-extension