sanitize whitespace and control chars in exported metric labels

[sayed0200]

mtail turns fields captured from log lines into metric label values, and the graphite, statsd and collectd exporters serialize those into line-oriented push protocols through formatLabels. That helper only rewrites the key and label separator characters, so any other protocol-significant byte in a value passes straight through untouched. Those values are attacker-controlled: the bundled apache_combined program captures the HTTP User-Agent with [[:print:]]+, which includes spaces, and a captured request path or filename can carry a space or a control byte just as easily. In graphite a space ends the metric path early so the rest of the value is parsed as the numeric sample and timestamp, and an embedded newline emits a second, fully forged metric record on the same connection, which is enough to spoof arbitrary series on the backend. I noticed it while reading how the separators were being escaped and realised whitespace and control characters were never covered by that same pass. The fix replaces whitespace and control runes in both keys and values with the replacement string already used for the separators, kept inside formatLabels so graphite, statsd and collectd are all covered without changing their call sites.