XLI_NORETURN macro to label functions that don't return

Typically, these functions either throw an exception or otherwise abort
execution.
Fix double free after String::SwapPtr()

Callers of SwapPtr take ownership of the returned string and are
responsible for delete[]ing it.

Upon return, String can be assumed invalidated -- as it will be, unless
it is using the internal buffer.
Use free/malloc for C-strings
Use return value of sprintf_s, instead of re-computing strlen
Practice safe formatting outside Windows too

Use C99 bounds-checking versions of the printf and scanf families of
functions.

Also, stop exporting our madness in externally visible #defines. While
we (mostly) control our use of the substituted functions, the Microsoft
versions are not completely equivalent to the standard C99 ones and care
must be taken. In String::Format we take a user-supplied format string
and pass it to either vsnprintf_s (MS-specific) or vsnprintf (C99),
which could become a problem.
Unused local variable, leftover from ff2bf686
Merge pull request #71 from Outracks/feature-VariousFixes

Mostly fixes to String, also introduces XLI_NORETURN