This fixes two things:
1) when `project.policy("build.sanitizer.address")` is true, there is no way to disable asan on a package, `add_requires("xx", { configs { asan = false } })` won't work because of the `or` (it should check for nil)
2) When asan is set to false, it won't match installed packages with asan key set to nil even though they are identical. So when asan/lto key is set to false, it will remove the asan/lto key from config
