build: Use -Werror=format-security

Reduce the chance of introducing a class of bugs quite hard to track.

configure

@@ -4452,6 +4452,7 @@ elif enabled gcc; then
     check_cflags -Werror=return-type
     check_cflags -Werror=declaration-after-statement
     check_cflags -Werror=vla
+    check_cflags -Werror=format-security
     enabled extra_warnings || check_disable_warning -Wno-maybe-uninitialized
 elif enabled llvm_gcc; then
     check_cflags -mllvm -stack-alignment=16