It's not a runtime flag, you'll have to patch redhat-rpm-config to use _FORTIFY_SOURCE=3 instead of 2 and then build packages with it.
Of course if you only want to build your application with _FORTIFY_SOURCE=3, you can do it right away even on Fedora 36. The Fedora change will be to build the distribution (or at least a subset of packages) with _FORGIFY_SOURCE=3.
What would be the impact of making _FORTIFY_SOURCE=3 a Fedora-specific Make default (which doesn't apply to CMake or Ninja because those are different defaults, which are for GCC not LLVM/Clang anyway)?
