doc: describe printf control character restriction in signal-safe mode