Explicitly disable CFI in bp2build when false

In Soong, CFI being explicitly set to false overrides presence in
CFI_INCLUDE_PATHS, so this change causes Bazel to mimic the same
precedence.

Bug: 278789968
Test: Unit tests
Change-Id: I827b3d4272eac2002031970f1e67c9321979b14b
diff --git a/cc/bp2build.go b/cc/bp2build.go
index eb91898..d09cdcd 100644
--- a/cc/bp2build.go
+++ b/cc/bp2build.go
@@ -1787,7 +1787,9 @@
 				blocklistFeatureSuffix := strings.Replace(strings.ToLower(*blocklist), ".", "_", -1)
 				features = append(features, "ubsan_blocklist_"+blocklistFeatureSuffix)
 			}
-			if proptools.Bool(sanitizerProps.Sanitize.Cfi) {
+			if sanitizerProps.Sanitize.Cfi != nil && !proptools.Bool(sanitizerProps.Sanitize.Cfi) {
+				features = append(features, "-android_cfi")
+			} else if proptools.Bool(sanitizerProps.Sanitize.Cfi) {
 				features = append(features, "android_cfi")
 				if proptools.Bool(sanitizerProps.Sanitize.Config.Cfi_assembly_support) {
 					features = append(features, "android_cfi_assembly_support")