Add Str\format, and support custom error messages to C\onlyx

Str\format is similar to sprintf, however it takes a Str\SprintfFormatString, which is somewhat stricter than the format specifier for sprintf. For example, %d requires an integer when using Str\format, however sprintf() is defined as accepting mixed in Hack, and in practice is happy to accept floats.

Str\SprintfFormatString is not stable: our goal is for this to be extremely strict about matching format string placeholder types against parameter types - we may make type restrictions narrower in the future.

C\onlyx now optionally takes a Str\SprintfFormatString argument and additional arguments for the placeholders.