Don't use user input as a format string in mjCError.

PiperOrigin-RevId: 469686222
Change-Id: Icb05df04f11387847aa8d66dcf1b63da9c470b9f

src/user/user_mesh.cc

@@ -540,7 +540,7 @@ void mjCMesh::LoadOBJ(const mjVFS* vfs) {
     std::stringstream msg;
     msg << "could not parse OBJ file '" << filename << "': \n"
         << objReader.Error();
-    throw mjCError(this, msg.str().c_str());
+    throw mjCError(this, "%s", msg.str().c_str());
   }
 
   auto attrib = objReader.GetAttrib();