xsnprintf: various improvements related to xvsnprintf() and xsnprintf()

Summary of changes:

* Make xvsnprintf() static
* restrict-qualify pointer arguments (as done by the libc equivalents)
* Make comments and spec references more thorough
* Remove pointless `n <= INT_MAX` assertion (see comment)
* Use FATAL_ERROR() instead of xassert() (since the assertion is inside
  a shared util function but the caller is responsible for ensuring the
  condition holds true)
* Change some callers to use size_t instead of int for the return value
  (negative returns are impossible and all subsequent uses are size_t)

The updated comments and code were taken (and adapted) from:

49260bb154/src/util/xsnprintf.c (L6-50)

This work was entirely authored by me and I hereby license this
contribution under the MIT license (stated explicitly, so that
there's no ambiguity w.r.t. the original license).

csi.c

@@ -2127,7 +2127,7 @@ csi_dispatch(struct terminal *term, uint8_t final)
 
         case 'R': {  /* XTREPORTCOLORS */
             char reply[64];
-            int n = xsnprintf(reply, sizeof(reply), "\033[?%zu;%zu#Q",
+            size_t n = xsnprintf(reply, sizeof(reply), "\033[?%zu;%zu#Q",
                               term->color_stack.idx, term->color_stack.size);
             term_to_slave(term, reply, n);
             break;