Pacify -Wformat-security.

There is no actual risk here, because the format string argument is
always one of a few string constants, set earlier in the function, but
apparently at least some versions of gcc are too stupid to do the
dataflow analysis to realize that.  And, to be fair, this way _is_
more future-proof.