Fix missing bounds checks in subgraph API functions

[mohammadmseet-hue]

Summary

Multiple public API functions in ynnpack accept user-controlled count/axis parameters
that are used as loop bounds or array indices without bounds checking, causing stack
buffer overflows:

• xnn_define_static_expand_dims (subgraph.cc): num_new_axes used as loop bound to write into int32_t ynn_axes[XNN_MAX_TENSOR_DIMS] (size 6). ASAN-confirmed stack-buffer-overflow with num_new_axes > 6.

• xnn_define_static_reduce (subgraph.cc): num_reduction_axes used as loop bound to write into int64_t signed_reduction_axes[XNN_MAX_TENSOR_DIMS] (size 6). Same pattern.

• ynn_define_broadcast (broadcast.cc): Missing validate_axis call. Out-of-range axes passed directly to axis_to_slinky_dim, producing negative results used as bitset<10> indices.

• ynn_define_broadcast_like (broadcast_like.cc): Same missing validation.

• ynn_define_reduce (reduce.cc): Same missing validation.

• ynn_define_fuse_dims (copy.cc): Off-by-one — axes[i] is validated but axes[i]+1 is passed to axis_to_slinky_dim. When axes[i] = rank-1, axes[i]+1 = rank produces index -1.

Fixes

• Add num_new_axes > XNN_MAX_TENSOR_DIMS / num_reduction_axes > XNN_MAX_TENSOR_DIMS bounds checks before stack array writes.
• Add validate_axis calls before axis_to_slinky_dim in broadcast, broadcast_like, and reduce.
• Add validate_axis for axes[i]+1 in fuse_dims.

ASAN trace (xnn_define_static_expand_dims, before fix)

==12==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7f69d2e1a0d8
WRITE of size 4 at 0x7f69d2e1a0d8 thread T0
    #0 in xnn_define_static_expand_dims
  [64, 88) 'ynn_axes' (line 774) <== Memory access at offset 88 overflows this variable

Test plan

• All 5 PoC tests pass with ASAN (no crashes after fix)
• bazel test //ynnpack/subgraph/test:oob_write_poc --copt=-fsanitize=address --linkopt=-fsanitize=address passes