Fix PGTYPESdate_fmt_asc overflow when a year does not fit "yyyy"

Hi, Hackers!

PGTYPESdate_fmt_asc() replaces fixed-width tokens in place. "yyyy"
is four characters. Callers typically size outbuf as
strlen(fmtstring)+1, as dt_test does.

For year >= 10000, "%04u" produces five or more digits. memcpy()
over the "yyyy" span overruns that token and clobbers the trailing
NUL in a strlen(fmt)+1 buffer. ASan reports a heap-buffer-overflow
on the next strstr() in the token loop.
```
const char *fmt = "yyyy";
date d = PGTYPESdate_from_asc("10000-01-01", NULL);
char *out = malloc(strlen(fmt) + 1);

PGTYPESdate_fmt_asc(d, fmt, out);
```
The attached patch rejects a replacement longer than the token and
sets errno to PGTYPES_DATE_BAD_DATE. A dt_test case is included.

--
Regards,
Rachitskiy Andrey