fix: CWE-134 format string vulnerability audit

Security:
- Fix CWE-134 in iq.c: user-controlled string passed as format arg

Annotations:
- Add G_GNUC_PRINTF to variadic functions in ui.h and log.h

Compiler flags (configure.ac):
- Add -Wformat -Wformat-nonliteral -Wno-format-zero-length

Format mismatch fixes:
- chatwin.c: Jid* instead of char* for %s
- connection.c: %x -> %lx for long flags
- cmd_funcs.c: %d -> %zu for MB_CUR_MAX/MB_LEN_MAX (size_t)
- cmd_funcs.c: cast gpointer to (char*) for %s
- cmd_defs.c: %d -> %u for g_list_length() (guint)
- iq.c: from_jid->barejid -> from_jid->fulljid
- console.c, mucwin.c, privwin.c, account.c, omemo.c, presence.c:
  gpointer -> (char*) casts for %s

Bug fixes:
- api.c: broken log_warning() calls with extra format arg
- cmd_funcs.c: remove unused arg from cons_show()

Tooling:
- Expand check-cwe134.sh detection patterns

src/ui/console.c

@@ -470,10 +470,10 @@ cons_show_wins(gboolean unread)
 
     GSList* curr = window_strings;
     while (curr) {
-        if (g_strstr_len(curr->data, strlen(curr->data), " unread") > 0) {
-            win_println(console, THEME_CMD_WINS_UNREAD, "-", "%s", curr->data);
+        if (g_strstr_len((char*)curr->data, strlen((char*)curr->data), " unread") > 0) {
+            win_println(console, THEME_CMD_WINS_UNREAD, "-", "%s", (char*)curr->data);
         } else {
-            win_println(console, THEME_DEFAULT, "-", "%s", curr->data);
+            win_println(console, THEME_DEFAULT, "-", "%s", (char*)curr->data);
         }
         curr = g_slist_next(curr);
     }
@@ -491,10 +491,10 @@ cons_show_wins_attention()
 
     GSList* curr = window_strings;
     while (curr) {
-        if (g_strstr_len(curr->data, strlen(curr->data), " unread") > 0) {
-            win_println(console, THEME_CMD_WINS_UNREAD, "-", "%s", curr->data);
+        if (g_strstr_len((char*)curr->data, strlen((char*)curr->data), " unread") > 0) {
+            win_println(console, THEME_CMD_WINS_UNREAD, "-", "%s", (char*)curr->data);
         } else {
-            win_println(console, THEME_DEFAULT, "-", "%s", curr->data);
+            win_println(console, THEME_DEFAULT, "-", "%s", (char*)curr->data);
         }
         curr = g_slist_next(curr);
     }
@@ -512,7 +512,7 @@ cons_show_room_invites(GList* invites)
     } else {
         cons_show("Chat room invites, use /join or /decline commands:");
         while (invites) {
-            cons_show("  %s", invites->data);
+            cons_show("  %s", (char*)invites->data);
             invites = g_list_next(invites);
         }
     }
@@ -591,7 +591,7 @@ cons_show_caps(const char* const fulljid, resource_presence_t presence)
             win_println(console, THEME_DEFAULT, "-", "Features:");
             GSList* feature = caps->features;
             while (feature) {
-                win_println(console, THEME_DEFAULT, "-", " %s", feature->data);
+                win_println(console, THEME_DEFAULT, "-", " %s", (char*)feature->data);
                 feature = g_slist_next(feature);
             }
         }
@@ -611,10 +611,10 @@ cons_show_received_subs(void)
     if (received == NULL) {
         cons_show("No outstanding subscription requests.");
     } else {
-        cons_show("Outstanding subscription requests from:",
+        cons_show("Outstanding subscription requests from (%d):",
                   g_list_length(received));
         while (received) {
-            cons_show("  %s", received->data);
+            cons_show("  %s", (char*)received->data);
             received = g_list_next(received);
         }
         g_list_free_full(received, g_free);
@@ -782,7 +782,7 @@ cons_show_disco_info(const char* jid, GSList* identities, GSList* features)
             cons_show("  Features:");
         }
         while (features) {
-            cons_show("    %s", features->data);
+            cons_show("    %s", (char*)features->data);
             features = g_slist_next(features);
         }
 
@@ -2297,7 +2297,7 @@ cons_show_themes(GSList* themes)
     } else {
         cons_show("Available themes:");
         while (themes) {
-            cons_show("%s", themes->data);
+            cons_show("%s", (char*)themes->data);
             themes = g_slist_next(themes);
         }
     }
@@ -2315,7 +2315,7 @@ cons_show_scripts(GSList* scripts)
     } else {
         cons_show("Scripts:");
         while (scripts) {
-            cons_show("%s", scripts->data);
+            cons_show("%s", (char*)scripts->data);
             scripts = g_slist_next(scripts);
         }
     }
@@ -2333,7 +2333,7 @@ cons_show_script(const char* const script, GSList* commands)
     } else {
         cons_show("%s:", script);
         while (commands) {
-            cons_show("  %s", commands->data);
+            cons_show("  %s", (char*)commands->data);
             commands = g_slist_next(commands);
         }
     }