[gentoo-hardened] Disabling SSP for one package

[Michael Orlitzky]

I'm hitting a nasty bug with SSP/PHP:

  https://bugs.gentoo.org/show_bug.cgi?id=491100

Recompiling PHP with hardenednossp fixes the problem, but on this one
server we're recompiling PHP a lot (as we figure out which extensions
are needed to migrate a bunch of classic ASP sites).

Supposing I'm very forgetful, what's the best way to prevent myself from
rebuilding PHP with SSP? Copy the ebuild to an overlay and locally mask
newer versions?