build: drop global suppression of -Wformat-nonliteral, fix fallouts

Extend two existing local suppressions to GCC, and add another
GCC-specific one as a replacement.

Before this patch suppressing this warning was odd with clang, because
after this option, `-Wformat=2` is used, which re-enables it.

Also:
- mprintf: minimize scope of a warning suppression.
- tests/server: suppress this warning for a system `vsnprintf()` call
  where it could trigger in C89 builds or with
  `CFLAGS=-DCURL_NO_FMT_CHECKS` set. Seen with Apple clang 17:
  ```
  curl/tests/server/util.c:114:37: warning: format string is not a string literal [-Wformat-nonliteral]
    114 |   vsnprintf(buffer, sizeof(buffer), msg, ap);
        |                                     ^~~
  /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/secure/_stdio.h:124:69: note: expanded from macro 'vsnprintf'
    124 | #define vsnprintf(str, len, ...) __vsnprintf_chk_func (str, len, 0, __VA_ARGS__)
        |                                                                     ^~~~~~~~~~~
  /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include/secure/_stdio.h:81:65: note: expanded from macro '__vsnprintf_chk_func'
     81 |         __builtin___vsnprintf_chk (str, len, flag, __darwin_obsz(str), format, ap)
        |                                                                        ^~~~~~
  ```

Ref: #20363

Closes #20366

src/tool_writeout.c

@@ -579,9 +579,16 @@ static const char *outtime(const char *ptr, /* %time{ ... */
     if(!result) {
       struct tm utc;
       result = curlx_gmtime(secs, &utc);
+#ifdef __GNUC__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wformat-nonliteral"
+#endif
       if(curlx_dyn_len(&format) && !result &&
          strftime(output, sizeof(output), curlx_dyn_ptr(&format), &utc))
         fputs(output, stream);
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
       curlx_dyn_free(&format);
     }
     ptr = end + 1;