Optionally include third-party headers with `-I` instead of `-isystem`

[ken-matsui]

We generally aren't concerned about third-party libraries' warnings (and clang-tidy checks), but security-conscious projects might still want to see those warnings, (preferably, without requiring Makefile to be regenerated).