mesa: prevent common string formatting security issues

Adds a compile-time error for obvious security issues like:

printf(string_var);

The proposed flage is more tolerant than -Wformat-nonliteral. Specifically, it tolerates common mesa formatting like:

static const char *shader_template = "really long string %d";
printf(shader_template, uniform_number);

The goal of this commit is to prevent bugs like Android build test failing on matrix.c