lint: in DEBUG mode, verify printf parameters for messages

Since several years GCC validates printf-style strings, and there is no
reason not to let GCC do that work.  This prevents bugs like the
segmentation fault that was fixed in tree.c 1.109 from 2021-01-01.

By default, lint is compiled with DEBUG off, but it's easy enough to
compile it in debug mode once in a while.

(rillig)