Allow (s)printf to be used for sanitising/escaping

Is your feature request related to a problem?

Yes. When writing code like the following, it's flagged as unescaped (WordPress.Security.EscapeOutput.OutputNotEscaped):

printf(
    'Foo %d Bar',
    $id
);

With some string formats, the format itself can provide adequate sanitising/escaping support. Specifically, any format which does not treat the input as a string: b, c, d, o, u, x, and X all treat the input as an integer, while e, E, f, F, g, and G treat the input as a double (eg float).

Essentially, only %s is unsafe for use printf for arbitrary variables, as all the others have the effect of typecasting to a number.

In practice, this only really matters for the EscapeOutput sniff with printf, but in theory, sprintf can actually be used as a sanitisation function as well; sprintf( '%d', $foo ) is a (weird) way to sanitise inputs into integer strings. (I've never seen this in practice though.)

Describe the solution you'd like

printf should be allowed to output input variables with any non-%s specifier without requiring unneeded escaping.

The following code should pass:

printf( 'Comment count: %d', $comment_count );
printf( 'Request time: %.4f', microtime( true ) );

(etc)

The issue does not name files or tests; start by locating the WordPress.Security.EscapeOutput.OutputNotEscaped sniff and its handling of printf and sprintf. Review how format specifiers are classified, then verify that the integer and float examples pass while %s input still requires escaping.