Sanitize inputs to strftime

Summary: strftime can read arbitrary memory. We sanitize the inputs before
calling strftime and throw an invalid arguement exception when they are out of
range.

Reviewed By: @JoelMarcey

Differential Revision: D1709836