Fix format string vulnerabilities

Never pass user input as first argument of printf(1),
similar to how you never do that with printf(3).

Signed-off-by: Thorsten Glaser <tg@mirbsd.org>
Display full paths in list-tracked*

Closes https://github.com/RichiH/vcsh/issues/125

Signed-off-by: Thorsten Glaser <tg@mirbsd.org>