[MERGE #4888 @xiaoyinl] Check buffer length in FNonZeroFiniteDblToStr
[MERGE #4888 @xiaoyinl] Check buffer length in FNonZeroFiniteDblToStr

Merge pull request #4888 from xiaoyinl:dbltostr_len

For the function `Js::NumberUtilities::FNonZeroFiniteDblToStr` (in `NumberUtilities_strtod.cpp`), if the input double value `dbl` is negative and `nDstBufSize` is zero, there's a buffer overflow. The buffer length is not checked before the buffer `ppsz` is written.

This is not currently triggerable, since all callers pass a 256 byte buffer. But I think it's good to check the length here just in case.

Microsoft/ChakraCore,Microsoft/ChakraCore,Microsoft/ChakraCore,Microsoft/ChakraCore,Microsoft/ChakraCore,Microsoft/ChakraCore