In order to have more robust code, we never work without an instance of
AuditLogFormatter. In fact, for all real code paths, it's always
possible to specify a valid AuditLogFormatter.
As fallback, we can provide an instance which should work for most
cases and which simply omits cosmetic details. Instead of directly
failing when we have to use the fallback (as previously), we can at
least give the fallback a try. That situation should never occur with
the current code but who knows which future code changes could result in
calling the fallback. Due to the tests added by Id3810e02fa, we have the
guarantee that the fallback isn't used for all foreseen cases.
Change-Id: I5466e586ee14bfa2d6b732619f0ec693d7312e4a
b8fbda4f13