Don't be stupid in how we use formatting functions.

One use of sprintf() where strcpy() would do.  Many uses of
vsnprintf() to a buffer that's then output, where vfprintf() would
avoid the risk of truncation, save the need for a buffer and do the
job directly.  (Also: each fprintf(out, "%s", buffer) should have been
an fputs(buffer, out) in the first place.)
Various format fixes for printf-style formatting.
Initialize uninitialized array !
Unused variable fix.

Don't bother with an intermediate variable when all you're going to do
with its value is assert it's NULL.  When NDEBUG is defined, the
variables were set but not used ...

Also change tests to use assert_true (testing checks) instead of
assert (program-level failures), prompted by Kristian's review
comments.
Make String2StringArray admit it doesn't change its first param.
Make StringSafeCompare a proper sort function.

Claiming that its second argument is bigger when either is NULL would
be A Bad Thing for some sort algorithms ("any" vs NULL gets different
answers depending on order passed).  So actually give a stable result,
treating NULL as less than any other string.
Removed unused parameter of static function.
Avoid uninitialized variable warning.
Eliminate unused parameter in static function.

It was used in an assertion; but the assertion just checked the passed
value matched what the one caller passed.  Boring.
Don't pass string literal as a char*.

A string literal should always be treated as const char*, and
functions that don't need to modify data pointed to by a parameter
should always declare them const.
Apparently we can't support size_t's z modifier in formats.

Solaris 9 allegedly handles %zu all wrong (and, somehow, the tests in
m4/snprintf.m4 don't avoid using this broken implementation natively).
DRY: move an fclose() earlier to avoid repeating it.

Close file handle after last use to save closing it on each returning
execution path after that.
Purge dangling hspace
Agent shouldn't stat parent directories on recursive copies.
Merge pull request #1363 from jimis/multi-tenancy

cf-serverd access control
Log promise type pass indices
Removed invalid comment.
All cf-serverd logging is prefixed with client IP address.
Redmine#4077: define special ignored package name and use it
Change separator to IPv6 friendly symbol.