stand: Add comment about CFLAGS pollution

Add a note that veriexec / bearssl builds will pollute the CFLAGS in a
way that's somewhat hard to fix, so I'm just noting it for now.

Sponsored by: Netflix

(cherry picked from commit 37dabb06e23a2435eab0a0b37d87258d92d0fd50)