It must be before CPPFLAGS so that an ICU installation in a nonstandard
path can take precedence over one in the system path.