build: enable missing OpenSSF-recommended warnings, with fixes

https://best.openssf.org/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C++.html
as of 2023-11-29 [1].

Enable new recommended warnings (except `-Wsign-conversion`):

- enable `-Wformat=2` for clang (in both cmake and autotools).
- add `CURL_PRINTF()` internal attribute and mark functions accepting
  printf arguments with it. This is a copy of existing
  `CURL_TEMP_PRINTF()` but using `__printf__` to make it compatible
  with redefinting the `printf` symbol:
  https://gcc.gnu.org/onlinedocs/gcc-3.0.4/gcc_5.html#SEC94
- fix `CURL_PRINTF()` and existing `CURL_TEMP_PRINTF()` for
  mingw-w64 and enable it on this platform.
- enable `-Wimplicit-fallthrough`.
- enable `-Wtrampolines`.
- add `-Wsign-conversion` commented with a FIXME.
- cmake: enable `-pedantic-errors` the way we do it with autotools.
  Follow-up to d5c0351055 #2747
- lib/curl_trc.h: use `CURL_FORMAT()`, this also fixes it to enable format
  checks. Previously it was always disabled due to the internal `printf`
  macro.

Fix them:

- fix bug where an `set_ipv6_v6only()` call was missed in builds with
  `--disable-verbose` / `CURL_DISABLE_VERBOSE_STRINGS=ON`.
- add internal `FALLTHROUGH()` macro.
- replace obsolete fall-through comments with `FALLTHROUGH()`.
- fix fallthrough markups: Delete redundant ones (showing up as
  warnings in most cases). Add missing ones. Fix indentation.
- silence `-Wformat-nonliteral` warnings with llvm/clang.
- fix one `-Wformat-nonliteral` warning.
- fix new `-Wformat` and `-Wformat-security` warnings.
- fix `CURL_FORMAT_SOCKET_T` value for mingw-w64. Also move its
  definition to `lib/curl_setup.h` allowing use in `tests/server`.
- lib: fix two wrongly passed string arguments in log outputs.
  Co-authored-by: Jay Satiro
- fix new `-Wformat` warnings on mingw-w64.

[1] 56c0fde389/docs/Compiler-Hardening-Guides/Compiler-Options-Hardening-Guide-for-C-and-C%2B%2B.md

Closes #12489

lib/memdebug.c

@@ -317,8 +317,16 @@ curl_socket_t curl_dbg_socket(int domain, int type, int protocol,
 
   sockfd = socket(domain, type, protocol);
 
-  if(source && (sockfd != CURL_SOCKET_BAD))
+  if(source && (sockfd != CURL_SOCKET_BAD)) {
+#ifdef __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-nonliteral"
+#endif
     curl_dbg_log(fmt, source, line, sockfd);
+#ifdef __clang__
+#pragma clang diagnostic pop
+#endif
+  }
 
   return sockfd;
 }
@@ -365,8 +373,16 @@ int curl_dbg_socketpair(int domain, int type, int protocol,
 
   int res = socketpair(domain, type, protocol, socket_vector);
 
-  if(source && (0 == res))
+  if(source && (0 == res)) {
+#ifdef __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-nonliteral"
+#endif
     curl_dbg_log(fmt, source, line, socket_vector[0], socket_vector[1]);
+#ifdef __clang__
+#pragma clang diagnostic pop
+#endif
+  }
 
   return res;
 }
@@ -386,8 +402,16 @@ curl_socket_t curl_dbg_accept(curl_socket_t s, void *saddr, void *saddrlen,
 
   curl_socket_t sockfd = accept(s, addr, addrlen);
 
-  if(source && (sockfd != CURL_SOCKET_BAD))
+  if(source && (sockfd != CURL_SOCKET_BAD)) {
+#ifdef __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-nonliteral"
+#endif
     curl_dbg_log(fmt, source, line, sockfd);
+#ifdef __clang__
+#pragma clang diagnostic pop
+#endif
+  }
 
   return sockfd;
 }
@@ -401,8 +425,16 @@ void curl_dbg_mark_sclose(curl_socket_t sockfd, int line, const char *source)
     "FD %s:%d sclose(%ld)\n":
     "FD %s:%d sclose(%zd)\n";
 
-  if(source)
+  if(source) {
+#ifdef __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-nonliteral"
+#endif
     curl_dbg_log(fmt, source, line, sockfd);
+#ifdef __clang__
+#pragma clang diagnostic pop
+#endif
+  }
 }
 
 /* this is our own defined way to close sockets on *ALL* platforms */
@@ -467,7 +499,14 @@ void curl_dbg_log(const char *format, ...)
     return;
 
   va_start(ap, format);
+#ifdef __clang__
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wformat-nonliteral"
+#endif
   nchars = mvsnprintf(buf, LOGLINE_BUFSIZE, format, ap);
+#ifdef __clang__
+#pragma clang diagnostic pop
+#endif
   va_end(ap);
 
   if(nchars > LOGLINE_BUFSIZE - 1)