Type-safe, buffer-safe printf to a C++ ostream or string