Fix out-of-bounds memory accesses with virtual_root=""

The CGit configuration variable virtual_root is normalized so that it
does not have a trailing '/' character, but it is allowed to be empty
(the empty string and NULL have different meanings here) and there is
code that is insufficiently cautious when checking if it ends in a '/':

	if (virtual_root[strlen(virtual_root) - 1] != '/')

Clearly this check is redundant, but rather than simply removing it we
get a slight efficiency improvement by switching the normalization so
that the virtual_root variable always ends in '/'.  Do this with a new
"ensure_end" helper.

Signed-off-by: John Keeping <john@keeping.me.uk>
Mark char* fields in struct cgit_page as const

Signed-off-by: John Keeping <john@keeping.me.uk>
html.c: add various strbuf and varadic helpers

This adds the fmtalloc helper, html_txtf, html_vtxtf, and html_attrf.

These takes a printf style format string like htmlf but escapes the
resulting string.  The html_vtxtf variant takes a va_list whereas
html_txtf is variadic.

Signed-off-by: John Keeping <john@keeping.me.uk>
shared.c: add strbuf_ensure_end

This is a small helper so that we can easily ensure that a strbuf ends
with the specified character.

Signed-off-by: John Keeping <john@keeping.me.uk>
Convert cgit_print_error to a variadic function

This removes many uses of "fmt" which uses a fixed size static pool of
fixed size buffers.  Instead of relying on these, we now pass around
argument lists for as long as possible before using a strbuf to render
content of an arbitrary size.

Signed-off-by: John Keeping <john@keeping.me.uk>
Remove redundant calls to fmt("%s", ...)

After this change there is one remaining call 'fmt("%s", delim)' in
ui-shared.c but is needed as delim is stack allocated and so cannot be
returned from the function.

Signed-off-by: John Keeping <john@keeping.me.uk>
use struct strbuf instead of static buffers

Use "struct strbuf" from Git to remove the limit on file path length.

Notes on scan-tree:
This is slightly involved since I decided to pass the strbuf into
add_repo() and modify if whenever a new file name is required, which
should avoid any extra allocations within that function.  The pattern
there is to append the filename, use it and then reset the buffer to its
original length (retaining a trailing '/').

Notes on ui-snapshot:
Since write_archive modifies the argv array passed to it we
copy the argv_array values into a new array of char* and then free the
original argv_array structure and the new array without worrying about
what the values now look like.

Signed-off-by: John Keeping <john@keeping.me.uk>