document restrictions on printf-format in signal-safe mode