crypt32: Only permit v1 or v2 CA certificates without a basic constraints extension if they're installed locally.

kernel32: Fix handling of width and precision arguments and remove assumptions about va_list implementation in FormatMessage.

This is to avoid calling WriteProperty with an index to a directory entry
that has not yet been reserved in the file. We reserve the entry by writing
the new data to it.

The meaning of the "index" argument in Read/WriteProperty will likely
change in the future, but getFreeProperty must work with real indexes
into the file's real directory stream.

The logic is unchanged from the original version.

Most of the work is the same regardless of relation type, so bring
those parts out of the relation type test.

Found by valgrind.

Perhaps IDirectDraw7_CreateSurface() should also always set "pSurface7" to
NULL on failure, but at least for our internal functions that's a silly thing
to rely on.