Stricter validation for GeoIP cookie

* record->city can be NULL. Handle gracefully.
* Strip control characters when sanitizing values.
* Use snprintf to synthesize GeoIP cookie, rather than VRT_WrkString.
* If the synthesized cookie had to be truncated to fit the buffer, don't
  include it.

Verify with "X-forwarded-for: 152.52.192.51".

Change-Id: I0038f675f19197c37824a6260d120b6113e0f345