Common function for percent placeholder replacement

There are a number of places where a shell command is constructed with
percent-placeholders (like %x). First, it's obviously cumbersome to
have to open-code this several times. Second, each of those pieces of
code silently encodes some edge case behavior, such as what to do with
unrecognized placeholders. (I remember when I last did one of these, I
stared very hard at the existing code instances to figure out what they
would do.) We now also have a newer instance in basebackup_to_shell.c
that has different behavior in such cases. (Maybe it's better, but it
would be good to be explicit and consistent about this.)

This patch factors out this logic into a separate function. I have
documented to "old" error handling (which is to not handle them) and
brutally converted basebackup_to_shell.c to use that. We could also
adopt the new behavior; now there is only a single place to change for that.

Note that this is only used for shell commands with placeholders, not
for other places with placeholders, such as prompts and log line
prefixes, which would (IMO) need a different API that wouldn't be quite
as compact. This is explained in the code comments.