Only destroy anonymous objects in the cil_destroy_* functions

Originally, cil_destroy_* functions often had code that looked like
this:

    if (x->foo_str != NULL) {
        strpool_release(x->foo_str)
    } else if (x->foo != NULL) {
        cil_destroy_foo(x->foo)
    }

So if x->foo was anonymous (because x->foo_str != NULL), then it
wouldn't destroy x->foo. It would only free foo_str. This is what we
wanted, since non-anonymous objects are destroyed later when the
declarative statement is destroyed.

However, when we moved to the string pool and subsequently removed
strpool_release, the code was changed to look something like this:

    if (x->foo != NULL) {
        cil_destroy_foo(x->foo)
    }

A side effect of this change was that we no longer checked for anonymity
when destroying x->foo. So we free'd all x->foo's regardless if they were
anonymous or not, which lead to double free's (once to free the
declarative object, and again to free everytime it is used).

This patch updates the cil_destroy_* functions to add back the check for
NULL foo_str and not free anonymous objects.

Signed-off-by: Steve Lawrence <slawrence@tresys.com>
Fix typo for pcidevicecon key

Signed-off-by: Yuli Khodorkovskiy <ykhodorkovskiy@tresys.com>
libsepol/cil: fix compilation with -Wformat-security

Once a printf format attribute is added to cil_log, compiling with gcc
-Wformat -Wformat-security -Werror fails with two kind of errors:

* format '%s' expects argument of type 'char *', but argument 3 has type 'void *'
* format '%n' expects argument of type 'int *', but argument 4 has type 'uint32_t'

The second one is quite surprising and it seems %n has been used instead
of %u several times in cil_resolve_ast.c.

Fix these printf-format-check errors.

Signed-off-by: James Carter <jwcart2@tycho.nsa.gov>