Address external path references in loaded models (#28709)
This pull request strengthens security checks around loading external
tensor data in ONNX Runtime, particularly to prevent malicious models
from referencing unsafe file paths or in-memory address markers that
could lead to arbitrary file access or unsafe memory dereferencing. The
changes introduce stricter validation for external data paths and add
explicit rejections for ORT in-memory address markers found in model
protobufs, along with new and improved regression tests to verify this
behavior.
**Security hardening for external data loading:**
* Added `ValidateExternalFilePathForTensor` to enforce that external
data paths are validated for all code paths loading external data
(including those outside `Graph::Resolve`), rejecting absolute or
directory-escaping paths and passing through only trusted in-memory
markers. This is now called in `GetExtDataFromTensorProto` and
`LoadExtDataToTensorFromTensorProto` to ensure defense-in-depth.
[[1]](diffhunk://#diff-d31e9fbe0f5334fcd949833e035f2b25d5ae810dcd505c545f6b372b546b1406R1568-R1596)
[[2]](diffhunk://#diff-d31e9fbe0f5334fcd949833e035f2b25d5ae810dcd505c545f6b372b546b1406R1760-R1762)
* Updated the validation logic for sparse tensor sub-tensors with
`ValidateSparseSubTensorExternalDataPath`, clarifying the handling of
in-memory markers and ensuring only legitimate file paths are accepted.
* Changed `SparseTensorProtoToDenseTensorProto` to use the new sparse
sub-tensor validation for both values and indices.
**Model loading and graph construction protections:**
* In `Graph::Graph`, added explicit rejection of ORT in-memory address
markers in sparse tensor attributes and initializers when loading from a
protobuf, preventing attackers from crafting models that could cause
unsafe memory access during sparse-to-dense conversion or initializer
resolution.
[[1]](diffhunk://#diff-e231a92b40d89409cc8e82436be0a15bc87ef95c93b303b9feaeab6e50c8835cR1268-R1282)
[[2]](diffhunk://#diff-e231a92b40d89409cc8e82436be0a15bc87ef95c93b303b9feaeab6e50c8835cR1322-R1331)
[[3]](diffhunk://#diff-e231a92b40d89409cc8e82436be0a15bc87ef95c93b303b9feaeab6e50c8835cR1373-R1380)
**Expanded and improved testing:**
* Added new unit tests to verify that absolute and directory-escaping
external paths are rejected even when loading tensors directly (not via
graph resolution), and that in-memory address markers are not accepted
in dense or sparse initializers loaded from protobufs.
[[1]](diffhunk://#diff-d75ec5db9cc4642f78b6ff568aff6d10398fc211b0fb7c862d3ec88738e3eda6R1156-R1217)
[[2]](diffhunk://#diff-1d3978c99d95a56af0f2603bdd0b10cf02bdc1cecbd4fe5db353a8c8388696efR1365-R1484)
* Updated an optimizer initializer test to reflect the new error
handling for invalid external data paths.
