fix(security): prevent CWE-134 format string injection

- add "%s" to unsafe cons_show/log_*/win_println calls
- add check-cwe134.sh static analysis script
- integrate security check into CI pipeline

Closes #85

.github/workflows/ci-code.yml

@@ -50,6 +50,9 @@ jobs:
         run: |
           grep -P 'auto_(char|gchar|gcharv|guchar|jid|sqlite|gfd|FILE)[\w *]*;$' -r src && exit -1 || true
 
+      - name: Check CWE-134 format string vulnerabilities
+        run: ./check-cwe134.sh
+
       - name: Install clang-format
         run: |
           sudo apt-get update