Use localtime_r() instead of localtime()

Even though the codebase is not threaded, the former is a safe function
and we should be using it to be future-proof.

Changelog: internal
Warned-by: lgtm