x86: split NX setup into separate file to limit unstack-protected code