build: specify -Wformat as a prerequisite of -Wformat-security