some lint cleanup

Mostly `gcc -Wwrite-strings' complaining about passing string
literals to safe_qbuf().  `gcc -Wformat' didn't catch the type mismatch
of formatting the return value of strlen() with %d, presumeably because
size_t is defined as unsigned int on this system and it treats int and
unsigned int as interchangeable as far as printf/scanf checking goes.

     I'm not sure whether the sizeof() values being passed to safe_qbuf()
ought to have casts.  Any system where size_t isn't the same width as
unsigned int is bound to support prototypes, but might possibly warn about
the implicit conversion of unsigned long (or even unsigned long long these
days) to unsigned int.

include/extern.h

@@ -1484,7 +1484,8 @@ E int NDECL(doloot);
 E int FDECL(use_container, (struct obj *,int));
 E int FDECL(loot_mon, (struct monst *,int *,boolean *));
 E int NDECL(dotip);
-E char *FDECL(safe_qbuf, (char *,unsigned,char *,char *,char *));
+E const char *FDECL(safe_qbuf, (const char *,unsigned,
+				const char *,const char *,const char *));
 
 /* ### pline.c ### */