Change Format::format to take Formatter argument by value

[BriocheBerlin]

Closes #277

[japaric]

https://github.com/knurling-rs/defmt/pull/305/checks?check_run_id=1558757983#step:6:117

  --> firmware/qemu/src/bin/double-write.rs:16:9
   |
15 |         defmt::write!(fmt, "one");
   |         -------------------------- value moved here
16 |         defmt::write!(fmt, "two");
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^ value used here after move
   |
   = note: move occurs because `fmt.inner` has type `&mut InternalFormatter`, which does not implement the `Copy` trait
   = note: this error originates in a macro (in Nightly builds, run with -Z macro-backtrace for more info)

this test (double-write.rs) can be removed. With these changes we don't need the runtime check because the issue is prevent at compile time.

[japaric]

Some follow-up work to do here. It doesn't need to be done in this PR but I wanted to jot down some notes somewhere:

• remove double/nested write! runtime check (no longer needed because we prevent the issue at compile time)
• update book / docs to mention the limitations of write! and the new Format::format signature
• add compile time tests that check that one cannot invoke write! twice within a Format::format implementation

[japaric]

https://github.com/knurling-rs/defmt/pull/305/checks?check_run_id=1558757817#step:6:147

a code snippet needs to be updated in the book

defmt/book/src/re-entrancy.md

Lines 16 to 26 in dd056e6

	``` rust
	# extern crate defmt;
	# struct X;
	impl defmt::Format for X {
	fn format(&self, f: &mut defmt::Formatter) {
	// ^ this is a handle to the global logger
	defmt::info!("Hello!");
	// ..
	}
	}
	```

like with API documentation, we test that the snippets compile to keep them in sync with library changes

[japaric]

bors r+

[bors]

Build succeeded:

• ci