Fix buffer overflows due to non-safe usage of sprintf

The combination of fixed size buffers and non-safe functions like
sprintf, which do not check the size of the buffer when writing, is
bad.

A malicious attacker could use this error to crash the web server, or
even execute code remotely (though I'm not sure how easy that is).

The exploits to make the web server segfault are simple:

  bash$ curl localhost:3000/"$(printf %.0sx {1..1024})" # request_handler
  bash$ curl localhost:3000/"$(printf %.0sx {1..2048})" # log_line

The size of the URL determines on which function crashes first.

I changed the unsafe code with snprintf's, which do check the size of
the buffer before writing. If the buffer is smaller than the source
string, only the data that fits will be written. The rest is
discarded.

I also put a not-really-smart MAX_BUFFER_SIZE limit that's so big,
that Mongoose will reject the request at smaller sizes, so we do not
have to worry about this.
Escape URL when writing to log

The request URL is written without escaping to the log file. This
could be an issue, because a malicious attacker can use this to forge
log entries. It can also be used to generate invalid log files which
could corrupt log parsing tools.

The proposed solution is to escape using percent encoding the URL,
leaving safe characters unescaped.

A sample exploit:

  bash$ curl localhost:3000/'%20from%208.8.8.8%0a%5b12/34/56%2069:96:42%20PM%5d%20GETOUTTAHERE%20Hello%20world!'
Merge branch 'fix_buffer_overflow'
Merge branch 'fix_weird_chars_log'