consider making `Format::format` take the `Formatter` by value

[japaric]

the issue: calling some (other type) format method more than once corrupts the defmt data stream

struct MyU8 { inner: u8 }

impl defmt::Format for MyU8 {
    fn format(&self, f: &mut defmt::Formatter) {
        self.inner.format(f); // OK
        self.inner.format(f); // corrupts the stream
    }
}

a solution could be to change the signature of Format::format to fn(&self, defmt::Formatter).
This way a format method can only be called once: calling the method more than once produces a compile error.

TBD:

• this compile time check should extend to write!
• does derive(Format) need to "undo" the value semantics to continue working?