Add more safety checks to variadic function calls in checked scope

[mgrang]

The checking of variadic functions in checked scope follows these rules:

1. All warnings issued by the -Wformat family of flags are errors in checked
   scope.
2. No bounds checking of arguments to variadic functions like printf/scanf,
   etc is done.

For printf-like functions:
3. %s is allowed only with arg type _Nt_array_ptr or _Nt_checked.
4. %p is allowed with any arg type.
5. %n is disallowed.
6. For all other format specifiers, only scalar arg types are allowed.

For scanf-like functions:
7. %s is disallowed.
8. All width modifiers to format specifiers are disallowed.
9. %p is disallowed
10. %n is disallowed
11. For all other format specifiers, only _Ptr arg types are allowed.

[mattmccutchen-cci]

It looks like this PR closes off all the safety holes in #1178 except printf_s_count (passing an out-of-bounds _Nt_array_ptr to printf %s). It seems that one inherently requires a bounds check.

[sulekhark]

LGTM! Thank you!

[kkjeer]

LGTM. Thanks!