'spectre' mitigations are tricky to enable

[MarkSchofield]

To enable full Spectre mitigations, the /Qspectre option needs to be passed to the compiler (which can be configured outside of the toolchain), and the linker path needs to pick up the CRT that is compiled with Spectre mitigations (which is trickier to configure outside of the toolchain). There should be an option - say, VS_ENABLE_SPECTRE - that the Toolchain uses to configure all Spectre mitigations.