Fix out-of-bounds memory accesses with virtual_root=""

The CGit configuration variable virtual_root is normalized so that it
does not have a trailing '/' character, but it is allowed to be empty
(the empty string and NULL have different meanings here) and there is
code that is insufficiently cautious when checking if it ends in a '/':

	if (virtual_root[strlen(virtual_root) - 1] != '/')

Clearly this check is redundant, but rather than simply removing it we
get a slight efficiency improvement by switching the normalization so
that the virtual_root variable always ends in '/'.  Do this with a new
"ensure_end" helper.

Signed-off-by: John Keeping <john@keeping.me.uk>
Mark char* fields in struct cgit_page as const

Signed-off-by: John Keeping <john@keeping.me.uk>
Remove redundant calls to fmt("%s", ...)

After this change there is one remaining call 'fmt("%s", delim)' in
ui-shared.c but is needed as delim is stack allocated and so cannot be
returned from the function.

Signed-off-by: John Keeping <john@keeping.me.uk>
---
Changes since v1:
- Fix a thinko: 'fmt("%s", path)' is equivalent to path not "%s".
cache.c: don't use statically sized buffers for filenames

Instead use "struct strbuf" from Git to remove the limit on file path
length.

Signed-off-by: John Keeping <john@keeping.me.uk>
html: introduce html_txtf and html_vtxtf functions

These takes a printf style format string like htmlf but escapes the
resulting string.  The html_vtxtf variant takes a va_list whereas
html_txtf is variadic.

Signed-off-by: John Keeping <john@keeping.me.uk>
Convert cgit_print_error to a variadic function

This removes many uses of "fmt" which uses a fixed size static pool of
fixed size buffers.  Instead of relying on these, we now pass around
argument lists for as long as possible before using a strbuf to render
content of an arbitrary size.

Signed-off-by: John Keeping <john@keeping.me.uk>
scan-tree: use struct strbuf instead of static buffers

This is slightly involved since I decided to pass the strbuf into
add_repo() and modify if whenever a new file name is required, which
should avoid any extra allocations within that function.  The pattern
there is to append the filename, use it and then reset the buffer to its
original length (retaining a trailing '/').

Signed-off-by: John Keeping <john@keeping.me.uk>

---
Changes since v1:
- Free the strbuf in is_git_dir.
- Free the strbuf in scan_projects.
ui-log.c: use a strbuf for refs

This avoids using a fixed-size buffer in fmt() for a user-supplied ref
string.

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-log.c: use a strbuf for grep arguments

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-plain.c: use struct strbuf instead of fmt()

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-refs.c: use struct strbuf instead of fixed-size buffers

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-repolist.c: use struct strbuf for repository paths

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-snapshot.c: tidy up memory management in write_archive_type

- Use a strbuf instead of a fixed-size buffer
- Free the argv_array when we're done with it

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-snapshot: use a struct strbuf instead of fixed-size buffers

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-summary.c: use struct strbuf instead of fixed-size buffers

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-tag.c: use struct strbuf for user-supplied data

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-tree.c: use struct strbuf instead of fmt()

Signed-off-by: John Keeping <john@keeping.me.uk>
cgit.c: use struct strbuf instead of fmt()

Signed-off-by: John Keeping <john@keeping.me.uk>
html: add html_attrf to output an attribute value from a format string

Signed-off-by: John Keeping <john@keeping.me.uk>
ui-shared.c: use struct strbuf instead of fmt()

Signed-off-by: John Keeping <john@keeping.me.uk>