CVE-2026-115920: ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank

ONNX ConvTranspose shape inference performed an out-of-bounds read when the weight tensor had fewer than three dimensions and the model did not provide a kernel_shape attribute.

The inference function derived an empty effective_kernel_shape vector from the undersized weight tensor, then indexed that vector once for each spatial dimension of the input tensor. A crafted model passed onnx.checker.check_model() and caused SIGSEGV when passed to onnx.shape_inference.infer_shapes().