Checking the return value of snprintf is a pain, as it must be
>= 0 and < sizeof(buffer).  git__fmt is a simple wrapper to
perform these checks.

Signed-off-by: Shawn O. Pearce <spearce@spearce.org>