CMake: ensure libs are built position-independent

Static libraries have to be built as position-independent, otherwise
they cannot be linked into a shared library which is built
position-independent (-fPIC).

Without this, linking objects into libcurl.so fails with:

    /usr/bin/ld: libngtcp2.a(ngtcp2_conn.c.o): relocation R_X86_64_PC32 against symbol `__asan_option_detect_stack_use_after_return' can not be used when making a shared object; recompile with -fPIC