rescue: set NO_SHARED in Makefile

The rescue binary is built statically via the Makefile generated by
crunchgen, but that does not trigger other shared/static logic in
bsd.prog.mk - in particular disabling retpolineplt with static linking.

PR: 233336
Reported by: Charlie Li
Sponsored by: The FreeBSD Foundation