Enable emutls with -flto for Android sanitize=cfi

-fsanitize=cfi requires LTO. Normally, the Clang driver automatically
enables emutls, but it's broken with -flto, so work around it by passing
-Wl,-plugin-opt=-emulated-tls.

See https://buganizer.corp.google.com/issues/72706604#comment15

Enable the workaround with ctx.Device(), which is the same condition used
in the existing I18acac41aac885fc6635fbd55f96ba7c845eb5e7 workaround.

Bug: b/72706604
Bug: https://github.com/android-ndk/ndk/issues/498
Test: m libaudioflinger (on internal master); \
  readelf -sW symbols/system/lib64/libaudioflinger.so | grep tlNBLogWriter
  check that __emutls_t.tlNBLogWriter exists
  check that no symbols of type TLS exist

Change-Id: I2cf65574c52476843cc017ee176a7d6777e2ce0b

cc/lto.go

@@ -82,7 +82,8 @@ func (lto *lto) flags(ctx BaseModuleContext, flags Flags) Flags {
 		flags.LdFlags = append(flags.LdFlags, ltoFlag)
 		if ctx.Device() {
 			// Work around bug in Clang that doesn't pass correct emulated
-			// TLS option to target
+			// TLS option to target. See b/72706604 or
+			// https://github.com/android-ndk/ndk/issues/498.
 			flags.LdFlags = append(flags.LdFlags, "-Wl,-plugin-opt,-emulated-tls")
 		}
 		flags.ArFlags = append(flags.ArFlags, " --plugin ${config.LLVMGoldPlugin}")