roff: safer strcpy() and sprintf() calls

This is based on a patch by Dirk-Wilhelm Peters <peters@schwertfisch.de>.
dir: support text direction with .>>, .<<, \> and \<

The following troff commands and requests specify text direction:

* .<< and .>> commands change the direction of text (.<< for r2l and .>>
  to l2r); the default direction is l2r.
* \< and \> change text direction temporarily

As an example, one can write:

  .<<
  This is a paragraph in a right-to-left language
  with some embedded \>left-to-right words\< in it.
  .>>

The current text direction and temporary direction are available
through td and cd number registers respectively; 0 for l2r and 1 for
r2l.

Normal and temporary indentation indent the right side of the lines
after ".<<"; to adjust the left side, this patch introduces base
indentation \n(.I, which can be specified as the second argument of
".in" command.  Base indentation always indents the left side of the
lines, regardless of the current text direction and ".ti" requests.
Note that the sum of \n(.i (or the temporary indent, if specified),
\n(.I, and the length of adjusted lines equals \n(.l.
fmt: keshideh justification

With ".ad k", neatroff inserts keshideh characters inside words of
filled lines, before adjusting with spaces.
font: glyph cursive attachments