clamp StringToIeee exponent accumulation against signed overflow

[Ramya-9353]

Repro: two valid inputs, both under INT_MAX bytes, overflow the exponent. "0." then 1073744823 0s then "1e-1073741823" underflows at string-to-double.cc:754 (UBSan: signed integer overflow -1073744824 + -1073741823); 1073743823 1s then "e1073741823" overflows at :768 (1073741823 + 1073743051).

Cause: StringToIeee accumulates the decimal exponent from digit runs that are bounded only by the input length. Leading fractional zeros decrement it with no floor, and the number of integer digits dropped past the significand limit is added to it, so a long enough integer or fractional part pushes it past int range. The parsed exponent field is capped at INT_MAX/2 and strtod clamps its own exponent (#308), but neither of these two accumulations was bounded.

Fix: floor the leading-zero and fractional decrements at -INT_MAX/4 (the range the assert just below them already documents) and combine the dropped-digit count in int64, clamped to INT_MAX/2. An exponent that large is far outside the double range, so valid results are unchanged; the two cases above now read as 0 and inf, and the ctest suite stays green.