Enabling the hardened runtime also enables library validation, which
means that the manifest generator may not be able to load the built
plugin if the generator runs before the signing step.

The manifest generator tools should not be distributed/archived, so
disabling the hardened runtime for these targets is appropriate.