lib: remove CONSTCOND comment

Since 2021-01-31, lint doesn't need it anymore for the common pattern of
'do ... while (0)'.

Fixed string truncation bug in flags_to_string(): SAPPEND() uses
sizeof(string) but string is a pointer to a malloc()ed buffer.

moved string_to_flags and flags_to_string from ls to libutil.