Fixes #86

Patch courtesy of Jakub Bogusz.

These were all caused by sprintf() appending a null char that was not actually used.
Fixes CVE-2021-30498 and CVE-2021-30499.

Fixes: #52 (CVE-2021-3410)

Fixes: #38 (CVE-2018-20546)
Fixes: #39 (CVE-2018-20547)

Fixes: #36 (CVE-2018-20544)

The slang internal auto-detection of utf8 is only executed by a call to
SLutf8_enable(-1).

- Only affect slang/ncurses.

The Xlib and ncurses libraries query the LC_CTYPE locale value to guess
the usable character set. If the calling program did not call setlocale(),
that character set will be severely limited. Extensive Unicode support
is a reasonable libcaca user expectation.

The locale is restored as soon as possible, once the window or terminal
have been initialised. Unfortunately, the effect of setlocale() is process-
wide, and may affect other threads. This is now documented.

Note also that both Xlib and ncurses ignore the effects of uselocale()
which would have been the thread-safe solution to this problem.

This fixes the path to source files in some unit tests and allows
to get rid of a few duplicate lines.

- Save and correctly restore console input mode, ie. do not
   change settings of the original console.
 - Fix hiding of cursor.
 - Free console again if the driver actually created a new one.
 - Default canvas size is current window size.
 - Base calculation on current font.
 - Properly handle press and release events of up to 5 mouse buttons.
 - Map right mouse button to button #3. This is a change in behaviour,
   which is desirable for cross-platform codes.
 - Generate two click events for double mouse clicks.
 - Mouse wheel support, creates button press events. Button numbers
   are identical to X11 mappings.
 - Handle window buffer resize events.

unit test for the problem. Bug found by Bastian Märkisch <bmaerkisch@web.de>.

outside the canvas.