Fix review comments from DL <https://info.ravenbrook.com/mail/2014/03/25/17-44-56/0/>.
Add __attribute__((__format__(printf))) to functions that take a printf-compatible format string (when building using GCC or Clang), so that format string mistakes can be detected statically.