Redefine ZERO_OBJ() to use memset().

Newer versions of the compilers have apparently set the source level
switches differently, so that explicit_bzero() is not defined as our
source is currently written. The autoconf AC_CHECK_FUNCS check
evidently sets certain source switches, but is not transparent
about which ones (this has become evident with strdup() as well).

On my machine, right now, defining _DEFAULT_SOURCE appears to do
the trick. But it is not obvious what else that turns on and off.

It is poor practice to cargo-cultishly turn on GNU_SOURCE for
everything. That risks portability and compatibility, and may make
us unwittingly dependent on non-standard features that may or may
not be supported elsewhere.

Besides, we only need ZERO_OBJ() for FREE_OBJ(), it frankly doesn't
matter much if we zero an object whose pointer is about to be free'd.