Account for string payloads in initializer size limits

[danielsongmicrosoft]

Summary

• Include string object storage and payload bytes in embedded initializer size limits.
• Use overflow-safe cumulative accounting while preserving normal and exact-boundary payloads.

Validation

• Warnings-as-errors build completed successfully.
• Focused string initializer boundary tests passed.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Copilot review overview

🟡 Changes recommended

Two tests incorrectly assume a specific sizeof(std::string), causing portability and coverage problems.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Make success-case budget portable across std::string ABIs · New
• Derive cumulative accounting budget from std::string size · New

What changed in this PR

Adds string object and payload accounting to embedded initializer size validation.

Changes:

• Adds overflow-safe cumulative string payload checks.
• Preserves the existing default limit via an overload.
• Adds boundary and normal-payload tests.

File	Description
onnxruntime/​core/​framework/​tensorprotoutils.cc	Implements string payload accounting.
onnxruntime/​core/​framework/​tensorprotoutils.h	Declares configurable-limit overload.
onnxruntime/​test/​framework/​tensorutils_test.cc	Adds string initializer limit tests.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.