CVE-2026-115921: ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute

ONNX shape inference did not safely validate the required Scan num_scan_inputs attribute. Two malformed values could terminate or disrupt the process:

1. If the attribute was missing, ctx.getAttribute("num_scan_inputs") returned null and was dereferenced.
2. If the attribute was negative, conversion to size_t produced a very large value that reached a vector allocation and raised std::length_error.

The negative-value variant passed onnx.checker.check_model() before reaching shape inference.