MSVC: Do not add /W3 to CMAKE_<LANG>_FLAGS by default

We do not add default warning flags on other compilers, and having
a warning flag in the default flags makes it hard for projects to
customize the warning level.  They need to use string processing
to remove `/W3` from `CMAKE_{C,CXX}_FLAGS`.  Therefore we should
drop it.

However, projects may be using string processing to replace `/W3`
with another flag, so we cannot simply drop it.  Add a policy to
drop it in a compatible way.

Fixes: #18317