Replace strcpy with safe string copy

[am11]

There are 10 usages of strcpy API under src/coreclr/nativeaot, but openbsd lld linker warns on this particular usage during PublishAot time. Overall, it's a harmless warning:

$ dotnet new webapiaot -n webapi-aot; cd $_
$ dotnet publish -o dist -c Release
Restore succeeded with 1 warning(s) in 2.7s
    /home/am11/projects/webapi-aot/webapi-aot.csproj : warning NU1603: webapi-aot depends on Microsoft.AspNetCore.OpenApi (>= 11.0.0-preview.7.26357.199) but Microsoft.AspNetCore.OpenApi 11.0.0-preview.7.26357.199 was not found. Microsoft.AspNetCore.OpenApi 11.0.0-preview.7.26358.101 was resolved instead.
    info NETSDK1057: You are using a preview version of .NET. See: https://aka.ms/dotnet-support-policy
  webapi-aot net11.0 openbsd-x64 succeeded with 2 warning(s) (30.5s) → dist/
    /home/am11/projects/webapi-aot/webapi-aot.csproj : warning NU1603: webapi-aot depends on Microsoft.AspNetCore.OpenApi (>= 11.0.0-preview.7.26357.199) but Microsoft.AspNetCore.OpenApi 11.0.0-preview.7.26357.199 was not found. Microsoft.AspNetCore.OpenApi 11.0.0-preview.7.26358.101 was resolved instead.
    ld.lld : warning gcenv.ee.cpp:571 (/dotnet/src/runtime/src/coreclr/nativeaot/Runtime/gcenv.ee.cpp:571)(gcenv.ee.cpp.o:(GCToEEInterface::CreateThread(void (*)(void*), void*, bool, char const*)) in archive /home/am11/.dotnet/packs/Microsoft.NETCore.App.Runtime.NativeAOT.openbsd-x64/11.0.0-preview.7.26357.199/runtimes/openbsd-x64/native/libRuntime.ServerGC.a): warning: strcpy() is almost always misused, please use strlcpy()

Build succeeded with 3 warning(s) in 38.2s

$ dist/webapi-aot
info: Microsoft.Hosting.Lifetime[14]
      Now listening on: http://localhost:5000
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Production
info: Microsoft.Hosting.Lifetime[0]
      Content root path: /home/am11/projects/webapi-aot
na^Cinfo: Microsoft.Hosting.Lifetime[0]
      Application is shutting down...

[1] 51537

$ curl -sSL http://localhost:5000/todos | jq
[
  {
    "id": 1,
    "title": "Walk the dog",
    "dueBy": null,
    "isComplete": false
  },
  {
    "id": 2,
    "title": "Do the dishes",
    "dueBy": "2026-07-11",
    "isComplete": false
  },
  {
    "id": 3,
    "title": "Do the laundry",
    "dueBy": "2026-07-12",
    "isComplete": false
  },
  {
    "id": 4,
    "title": "Clean the bathroom",
    "dueBy": null,
    "isComplete": false
  },
  {
    "id": 5,
    "title": "Clean the car",
    "dueBy": "2026-07-13",
    "isComplete": false
  }
]

[dotnet-policy-service]

Tagging subscribers to this area: @agocke, @dotnet/ilc-contrib
See info in area-owners.md if you want to be subscribed.

[jkotas]

under src/coreclr/nativeaot, but openbsd lld linker warns on this particular usage during PublishAot time.

Why does it warn on this one, and not on all the other ones?

[am11]

Others are probably inlined by clang.

[jkotas]

Thanks

[jkotas]

/ba-g infrastructure timeout