Fix most of the format string abuses including those which are known to cause
a security vulnerabilities. Not fixed are a number of more subtle cases which
may or may not allow security violations (I don't have time to conduct a
thorough audit now), and which are difficult/impossible to fix anyway without
something like fmtcheck(). Document this in pkg-install and remove FORBIDDEN
tag.