Remove most instances of strcpy and sprintf

OpenBSD whines about these and recommends using strlcpy / snprintf
instead. Since strlcpy isn't quite universal yet, we use strncpy instead
and be careful about terminating the string. We could implement a
portable strlcpy in terms of strncpy, but that'd add another function to
the namespace.

Yes, usually the length is obviously bounded. Still, pretending
strcpy/sprintf don't exist seems like a great strategy.

N.B. there are still a few occurrences of strcpy and sprintf under f/
and in libuv, but I don't have time to tackle them right now.