g_settings_get: check validity of format string

Allow only format strings that copy all values (i.e, don't contain '&'),
as the returned pointers might become invalid in some rare cases.

Since this is technically an API break, this patch only prints a
critical when a faulty format string is detected, but still fetches the
values.

https://bugzilla.gnome.org/show_bug.cgi?id=719979