Additional agerr() format string fixes

Similar to commit 99eda421, ensure the second argument to agerr() is
fixed string with no user inputs.  Change applied to:

* cmd/tools/gmlscan.l - unclear if this can be exploited in practice, as
  only yytext can possibly hold format string
* lib/graph/lexer.c - format string can be injected via graph file
  content.  Note that libgraph is deprecated as of version 2.30.0, so
  this fix is more relevant for older graphviz versions.