Replace all snprintf() calls with M_snprintf().

The Windows API has an _snprintf function that is not the same as
Unix's snprintf(): if the string is truncated then no trailing NUL
character is appended. This makes the function unsafe. Define a
replacement/wrapper called M_snprintf that works the same but always
appends a trailing NUL, for safety on Windows and other OSes that
behave like this.

Do the same thing for vsnprintf(), and update HACKING to list
snprintf/vsnprintf as forbidden functions. This fixes #375;
thanks to Quasar for pointing out the different behavior of these
functions.
setup: Eliminate use of sprintf().

Use M_snprintf() or M_StringJoin() instead where appropriate.
This fixes #371.
textscreen: Use safe string functions.

Define TXT_{StringCopy,StringConcat,snprintf,vsnprintf} as analogs of
the m_misc.c versions so that the textscreen library does not need a
dependency on the Doom code, and change all textscreen code to use
these instead of unsafe functions. This fixes #372.
osx: Use safe string functions for launcher.

The OS X launcher used a few unsafe string functions; use snprintf()
or strlcpy,strlcat here - as this is the launcher for OS X we don't
need to care about portability.
misc: Tweak safe string functions slightly.

Properly handle cases where a very small string buffer is specified.