Don't hide the real compiler flags to allow automatic checks for missing (hardening) flags via blhc. It avoids buildd log scanner tag W-compiler-flags-hidden.
Use PKG_CHECK_MODULES to detect libxml2, libxslt and libexslt. Also remove the STATIC_LIBS build option, since Debian doesn't ship static libraries for libxslt or libexslt.