Validate Col2Im inputs to prevent heap over-read (#28706)
### Description
The CPU `Col2Im` kernel derived the output spatial extent from the
`image_shape` and `block_shape` runtime inputs and dispatched to
`math::Col2im` / `math::Col2imNd` without checking that the column
tensor actually contained the implied number of sliding-block positions.
A crafted model whose `image_shape` implies more sliding-block positions
than the column allocation holds caused the inner loop in `math::Col2im`
to advance past the end of `data_col` and copy adjacent heap contents
into the output tensor, leaking process memory to the caller.
### Motivation and Context
Heap buffer over-read in `Col2Im` reported as an information-disclosure
issue. Reproducer: `col` shape `[1, 1, 4]` with `image_shape = [4, 4]`
and `block_shape = [1, 1]` produces a `[1, 1, 4, 4]` output whose first
4 elements are the input data and whose remaining 12 elements are
uninitialized heap values that vary across runs.
### Fix
In `onnxruntime/core/providers/cpu/tensor/col2im.cc`, validate inputs
before dispatch:
- `image_shape` and `block_shape` are 1-D and have the same length, with
at least one spatial dimension.
- All `image_shape` and `block_shape` values are positive.
- Padded image extent is at least as large as the dilated kernel in each
spatial dimension.
- `col` (input 0) is rank 3.
- `col_shape[1]` is a positive multiple of `prod(block_shape)`.
- `col_shape[2]` equals the expected sliding-block count derived from
`image_shape`, `block_shape`, `pads`, `strides`, and `dilations`.
Existing `ORT_ENFORCE` attribute-size checks are converted to
`ORT_RETURN_IF_NOT` so all validation surfaces as a clean `Status`
failure rather than an exception.
### Test
Added regression test `Col2ImOpTest.ImageShapeLargerThanColumnTensor` in
`onnxruntime/test/providers/cpu/tensor/col2im_test.cc` that mirrors the
reproducer and expects the kernel to fail with a message identifying the
sliding-block mismatch.
Local run of `onnxruntime_provider_test --gtest_filter=Col2ImOpTest.*`
on Windows / Release passes all 7 tests (6 existing + 1 new).
---------
Co-authored-by: Gopalakrishnan Nallasamy <gnallasamy@microsoft.com>
