os_log: When there are multiple privacy annotations in the format

string, choose the strictest one instead of the last.

Also fix an undefined behavior. Move the pointer update to a later point to
avoid adding StringRef::npos to the pointer.

rdar://problem/40706280

llvm-svn: 336863