We add NSS_CFLAGS in preparation of equivalent changes to crates that are vendored in third-party/rust that use netwerk/socket/neqo/extra-bindgen-flags (that we thus keep around for now). Differential Revision: https://phabricator.services.mozilla.com/D239831