Use SafeInt for overflow-safe coefficients size validation

Address review feedback: the multiplication of num_targets * num_features
could overflow with very large dimensions. Use SafeInt for checked
multiplication and also reject negative num_targets.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: bmehta001

onnxruntime/core/providers/cpu/ml/linearregressor.cc

@@ -89,7 +89,9 @@ Status LinearRegressor::Compute(OpKernelContext* ctx) const {
 
   // Coefficients are treated as a [num_targets, num_features] matrix.
   // Validate size to prevent out-of-bounds reads in the GEMM backend.
-  if (coefficients_.size() != static_cast<size_t>(num_targets_) * static_cast<size_t>(num_features)) {
+  // Use SafeInt for overflow-safe multiplication.
+  if (num_targets_ < 0 ||
+      coefficients_.size() != SafeInt<size_t>(num_targets_) * static_cast<size_t>(num_features)) {
     return ORT_MAKE_STATUS(ONNXRUNTIME, INVALID_ARGUMENT,
                            "LinearRegressor: coefficients attribute size (", coefficients_.size(),
                            ") does not match targets (", num_targets_,