Update microsoft_gsl from v4.0.0 to v4.2.1 (fixes C4875 deprecation) (#28527)

### Description

Upgrades `microsoft_gsl` to v4.2.1 and patches `GSL_SUPPRESS` to
stringify its argument for MSVC, fixing the C4875 deprecation warning in
VC++ 18.6.0.

- **`cmake/deps.txt`** — Bump to v4.2.1
- **`cmake/patches/gsl/1064.patch`** — Removed; the NVCC guard
(`!defined(__NVCC__)`) is already upstream in v4.2.1
- **`cmake/patches/gsl/1213.patch`** — New patch: `[[gsl::suppress(x)]]`
→ `[[gsl::suppress(#x)]]` for MSVC, matching upstream
microsoft/GSL@543d0dd (PR microsoft/GSL#1213)
- **`cmake/external/onnxruntime_external_deps.cmake`** — Removed the
`if(onnxruntime_USE_CUDA)` conditional around the patch; the stringify
fix applies to all MSVC builds, not just CUDA
- **`cmake/vcpkg.json`** — Added `"version>=": "4.2.1"` constraint for
`ms-gsl` to ensure vcpkg builds also pick up a version that includes the
NVCC guard fix

### Motivation and Context

GSL v4.0.0's `GSL_SUPPRESS` macro passes a non-string-literal to
`[[gsl::suppress()]]`. VC++ 18.6.0 deprecates this form (C4875), and a
future MSVC release will remove it entirely, breaking the build. The
warning fires on essentially every translation unit via `capture.h` /
`narrow.h`.

The upstream fix (stringify via `#x`) hasn't shipped in a GSL release
yet, so a local patch is still needed until a future GSL release
includes it.

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: tianleiwu <30328909+tianleiwu@users.noreply.github.com>
Co-authored-by: Tianlei Wu <tlwu@microsoft.com>

Author: Copilot

cmake/deps.txt

@@ -30,7 +30,7 @@ googletest;https://github.com/google/googletest/archive/refs/tags/v1.17.0.zip;f6
 #xnnpack 2025.06.22
 googlexnnpack;https://github.com/google/XNNPACK/archive/3cf85e705098622d59056dcb8f5f963ea7bb0a00.zip;6f6bbba627241f89463ca845febaf063982b34fe
 json;https://github.com/nlohmann/json/archive/refs/tags/v3.11.3.zip;5e88795165cc8590138d1f47ce94ee567b85b4d6
-microsoft_gsl;https://github.com/microsoft/GSL/archive/refs/tags/v4.0.0.zip;cf368104cd22a87b4dd0c80228919bb2df3e2a14
+microsoft_gsl;https://github.com/microsoft/GSL/archive/refs/tags/v4.2.1.zip;1094e3bb7a8af763dcb136ccd676e6e75e614eec
 microsoft_wil;https://github.com/microsoft/wil/archive/refs/tags/v1.0.250325.1.zip;826c8bd47c2258ec61b8b218e031e5b33d27f761
 mimalloc;https://github.com/microsoft/mimalloc/archive/refs/tags/v2.1.1.zip;d5ee7d34223d0567892db5179849939c8769dc41
 mp11;https://github.com/boostorg/mp11/archive/refs/tags/boost-1.82.0.zip;9bc9e01dffb64d9e0773b2e44d2f22c51aace063

cmake/external/onnxruntime_external_deps.cmake

@@ -405,24 +405,16 @@ if (CPUINFO_SUPPORTED)
   endif()
 endif()
 
-if(onnxruntime_USE_CUDA)
-  onnxruntime_fetchcontent_declare(
-    GSL
-    URL ${DEP_URL_microsoft_gsl}
-    URL_HASH SHA1=${DEP_SHA1_microsoft_gsl}
-    PATCH_COMMAND ${Patch_EXECUTABLE} --binary --ignore-whitespace -p1 < ${PROJECT_SOURCE_DIR}/patches/gsl/1064.patch
-    EXCLUDE_FROM_ALL
-    FIND_PACKAGE_ARGS 4.0 NAMES Microsoft.GSL
-  )
-else()
-  onnxruntime_fetchcontent_declare(
-    GSL
-    URL ${DEP_URL_microsoft_gsl}
-    URL_HASH SHA1=${DEP_SHA1_microsoft_gsl}
-    EXCLUDE_FROM_ALL
-    FIND_PACKAGE_ARGS 4.0 NAMES Microsoft.GSL
-  )
-endif()
+onnxruntime_fetchcontent_declare(
+  GSL
+  URL ${DEP_URL_microsoft_gsl}
+  URL_HASH SHA1=${DEP_SHA1_microsoft_gsl}
+  # Stringify fix for GSL_SUPPRESS on MSVC (C4875). Remove when GSL ships a release
+  # containing microsoft/GSL#1213 (commit 543d0dd).
+  PATCH_COMMAND ${Patch_EXECUTABLE} --binary --ignore-whitespace -p1 < ${PROJECT_SOURCE_DIR}/patches/gsl/1213.patch
+  EXCLUDE_FROM_ALL
+  FIND_PACKAGE_ARGS 4.0 NAMES Microsoft.GSL
+)
 set(GSL_TARGET "Microsoft.GSL::GSL")
 set(GSL_INCLUDE_DIR "$<TARGET_PROPERTY:${GSL_TARGET},INTERFACE_INCLUDE_DIRECTORIES>")
 onnxruntime_fetchcontent_makeavailable(GSL)

cmake/patches/gsl/1064.patch

@@ -0,0 +1,13 @@
+diff --git a/include/gsl/assert b/include/gsl/assert
+index 58e0426..b3f7c8a 100644
+--- a/include/gsl/assert
++++ b/include/gsl/assert
+@@ -50,7 +50,7 @@
+ #define GSL_SUPPRESS(x) [[gsl::suppress(#x)]]
+ #else
+ #if defined(_MSC_VER) && !defined(__INTEL_COMPILER) && !defined(__NVCC__)
+-#define GSL_SUPPRESS(x) [[gsl::suppress(x)]]
++#define GSL_SUPPRESS(x) [[gsl::suppress(#x)]]
+ #else
+ #define GSL_SUPPRESS(x)
+ #endif // _MSC_VER

cmake/patches/gsl/1213.patch

@@ -40,7 +40,10 @@
       "name": "mimalloc",
       "platform": "windows"
     },
-    "ms-gsl",
+    {
+      "name": "ms-gsl",
+      "version>=": "4.2.1"
+    },
     "nlohmann-json",
     "onnx",
     {