fix: CWE-134 format string audit and compiler hardening

Security:
Fix CWE-134 in iq.c: user-controlled string passed as format argument
Add G_GNUC_PRINTF annotations to all variadic printf-like wrappers
in ui.h, log.h and http_common.h
Compiler flags (configure.ac):

Replace basic -Wformat/-Wformat-nonliteral with -Wformat=2
Add -Wextra, -Wnull-dereference, -Wpointer-arith,
-Wimplicit-function-declaration, -Wundef, -Wfloat-equal,
-Wredundant-decls, -Walloc-zero
Add -fstack-protector-strong, -fno-common, -D_FORTIFY_SOURCE=2
Add GCC-specific flags via AC_COMPILE_IFELSE: -Wlogical-op,
-Wduplicated-cond, -Wduplicated-branches, -Wstringop-overflow,
-Warray-bounds=2
Suppress noisy -Wextra sub-warnings: -Wno-unused-parameter,
-Wno-missing-field-initializers, -Wno-sign-compare,
-Wno-cast-function-type
Remove AM_CFLAGS/CFLAGS duplication
Bug fixes found by new warnings:

chatlog.c: non-MUCPM redact path passed resourcepart instead of NULL
rosterwin.c: merge duplicated if/else branches into single condition
omemo.c: redundant else-if in omemo_automatic_start; remove
unnecessary scope block and goto, use early return
console.c: pointer compared to integer 0 instead of NULL
stanza.c: increase pri_str/idle_str buffers from 10 to 12 bytes
(INT_MIN = -2147483648 needs 12 bytes including NUL)
vcard.c: NULL guard for filename before g_file_set_contents
api.c: broken log_warning() calls with extra format argument
Format mismatch fixes:

chatwin.c: Jid* → char* for %s
connection.c: %x → %lx for long flags
cmd_funcs.c: %d → %zu for size_t; cast gpointer to char* for %s
cmd_defs.c: %d → %u for g_list_length() return (guint)
iq.c: barejid → fulljid for from_jid
console.c, mucwin.c, privwin.c, account.c, omemo.c, presence.c:
gpointer → (char*) casts for %s
Const-correctness and cleanup:

database.c: const for type, query, sort variables
form.c/xmpp.h: const for form_set_value parameter
files.c: refactor to early return, eliminating NULL logfile path
muc.c/muc.h: remove meaningless top-level const on return type
common.c: const for URL string literal
Remove stale declarations: cons_show_desktop_prefs (ui.h),
connection_set_priority (connection.h),
omemo_devicelist_configure_and_request (omemo.h)
test_common.c: add currb NULL check to silence -Wnull-dereference
Tooling (check-cwe134.sh):

Reduce from 5 checks to 2 (checks 1-3 redundant with -Wformat=2)
Check 1: verify known wrappers have G_GNUC_PRINTF attribute
Check 2: auto-detect unannotated variadic printf-like functions
Match both const char* and const gchar* in variadic patterns

Author: jabber.developer2 <jabber.developer2@jabber.space>

src/command/cmd_defs.c

@@ -3067,7 +3067,7 @@ command_docgen(void)
 
     fclose(toc_fragment);
     fclose(main_fragment);
-    printf("\nProcessed %d commands.\n\n", g_list_length(cmds));
+    printf("\nProcessed %u commands.\n\n", g_list_length(cmds));
     g_list_free(cmds);
 }
 
@@ -3145,7 +3145,7 @@ command_mangen(void)
         curr = g_list_next(curr);
     }
 
-    printf("\nProcessed %d commands.\n\n", g_list_length(cmds));
+    printf("\nProcessed %u commands.\n\n", g_list_length(cmds));
 
     g_list_free(cmds);
 }

src/command/cmd_funcs.c

@@ -2271,7 +2271,7 @@ cmd_group(ProfWin* window, const char* const command, gchar** args)
         if (curr) {
             cons_show("Groups:");
             while (curr) {
-                cons_show("  %s", curr->data);
+                cons_show("  %s", (char*)curr->data);
                 curr = g_list_next(curr);
             }
 
@@ -3109,7 +3109,7 @@ cmd_blocked(ProfWin* window, const char* const command, gchar** args)
     if (curr) {
         cons_show("Blocked users:");
         while (curr) {
-            cons_show("  %s", curr->data);
+            cons_show("  %s", (char*)curr->data);
             curr = g_list_next(curr);
         }
     } else {
@@ -5190,7 +5190,7 @@ cmd_charset(ProfWin* window, const char* const command, gchar** args)
     if (codeset) {
         cons_show("  CODESET:    %s", codeset);
     }
-    cons_show("  MB_CUR_MAX: %d", MB_CUR_MAX);
+    cons_show("  MB_CUR_MAX: %zu", MB_CUR_MAX);
     cons_show("  MB_LEN_MAX: %d", MB_LEN_MAX);
 
     return TRUE;
@@ -5624,7 +5624,7 @@ cmd_notify(ProfWin* window, const char* const command, gchar** args)
                     cons_show("No room notification triggers");
                 }
                 while (curr) {
-                    cons_show("  %s", curr->data);
+                    cons_show("  %s", (char*)curr->data);
                     curr = g_list_next(curr);
                 }
                 g_list_free_full(triggers, free);
@@ -6299,7 +6299,7 @@ cmd_reconnect(ProfWin* window, const char* const command, gchar** args)
     } else if (strtoi_range(value, &intval, 0, INT_MAX, &err_msg)) {
         prefs_set_reconnect(intval);
         if (intval == 0) {
-            cons_show("Reconnect disabled.", intval);
+            cons_show("Reconnect disabled.");
         } else {
             cons_show("Reconnect interval set to %d seconds.", intval);
         }
@@ -6858,7 +6858,7 @@ cmd_plugins_install(ProfWin* window, const char* const command, gchar** args)
                 cons_show("");
                 cons_show("Installed and loaded plugins (%u):", g_slist_length(curr));
                 while (curr) {
-                    cons_show("  %s", curr->data);
+                    cons_show("  %s", (char*)curr->data);
                     curr = g_slist_next(curr);
                 }
             }
@@ -6867,7 +6867,7 @@ cmd_plugins_install(ProfWin* window, const char* const command, gchar** args)
                 cons_show("");
                 cons_show("Failed installs (%u):", g_slist_length(curr));
                 while (curr) {
-                    cons_show("  %s", curr->data);
+                    cons_show("  %s", (char*)curr->data);
                     curr = g_slist_next(curr);
                 }
             }
@@ -6969,7 +6969,7 @@ cmd_plugins_load(ProfWin* window, const char* const command, gchar** args)
             cons_show("Loaded plugins:");
             GSList* curr = loaded;
             while (curr) {
-                cons_show("  %s", curr->data);
+                cons_show("  %s", (char*)curr->data);
                 curr = g_slist_next(curr);
             }
             g_slist_free_full(loaded, g_free);
@@ -7101,7 +7101,7 @@ cmd_plugins(ProfWin* window, const char* const command, gchar** args)
         GSList* curr = unloaded_plugins;
         cons_show("The following plugins already installed and can be loaded:");
         while (curr) {
-            cons_show("  %s", curr->data);
+            cons_show("  %s", (char*)curr->data);
             curr = g_slist_next(curr);
         }
         g_slist_free_full(unloaded_plugins, g_free);
@@ -7111,7 +7111,7 @@ cmd_plugins(ProfWin* window, const char* const command, gchar** args)
         GList* curr = plugins;
         cons_show("Loaded plugins:");
         while (curr) {
-            cons_show("  %s", curr->data);
+            cons_show("  %s", (char*)curr->data);
             curr = g_list_next(curr);
         }
         g_list_free(plugins);