onnxruntime

f05b2186 - Enable Spectre-mitigated MSVC libs for BinSkim builds (#29624)

Enable Spectre-mitigated MSVC libs for BinSkim builds (#29624) ### Description This updates the Windows BinSkim-compliant build flags so `/Qspectre` builds also link against the MSVC Spectre-mitigated CRT/STL static libraries. `/Qspectre` only affects ONNX Runtime's own object files; BinSkim BA2024 can still report violations when the default non-Spectre `libcmt.lib`, `libcpmt.lib`, or `libvcruntime.lib` are linked into the final binary. ### Motivation and Context Release validation reported BinSkim BA2024 (`EnableSpectreMitigations`) warnings for `onnxruntime.dll` even when ORT was built with `--use_binskim_compliant_compile_flags`. The warning identified MSVC runtime and STL static libraries as the non-mitigated modules. This change makes the build option select the Spectre-mitigated MSVC library directory when it is available from the Visual Studio toolset. ### Key Changes - Adds `get_msvc_spectre_lib_dir()` to locate `%VCToolsInstallDir%\lib\spectre\<arch>` for the target Windows architecture. - Appends a quoted `/LIBPATH:<spectre-lib-dir>` linker flag whenever Windows BinSkim flags enable `/Qspectre` and AddressSanitizer is not enabled. - Emits a warning when the Spectre-mitigated MSVC libraries cannot be found, with guidance to install the Visual Studio "C++ Spectre-mitigated libs" component. - Preserves the existing ASAN behavior because ASAN libraries do not have Spectre-mitigated variants. ### Testing - `python3 -m ruff check tools/ci_build/build.py` - `python3 -m ruff format --check tools/ci_build/build.py` `lintrunner -a tools/ci_build/build.py` was also attempted. It found the repository config and applied no file changes, but the local environment could not execute the Ruff lintrunner adapters because `python` is not available on PATH; the direct `python3 -m ruff` checks above passed. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>